Payy Loses $1.92 Million in USDC Bridge Drain

Payy, a network for private stablecoin payments, was hit by a significant loss of $1.92 million in USDC from its Ethereum bridge on September 24. The funds were drained in two batches, with the first sending $1,828,589 to an address and leaving about $95,000 remaining. A second batch five hours later sent another 90,202 USDC to the same address, leaving only around $700.

Ethereum records show that every one of the last 200 transactions from the address posting batches to the bridge was a verifyRollup call. The receiving address had used Payy before, depositing and withdrawing small amounts on September 22 and 23. Within eight minutes, the first payout was moved to a second address and sold for roughly 683 ETH through UniswapX.

Payy has ruled out compromised keys, social engineering, or an exploit of its off-chain infrastructure as the cause of the drain. The company is working with an audit firm to confirm the findings and aims to release a validated report within the next few days. It has paused Payy Wallet and flagged the attacker's addresses to law enforcement, exchanges, and blockchain analytics firms.