Chainflip lost 736,442.17 USDT through six unauthorized payouts after an attacker exploited how the cross-chain protocol processes TRON transaction memos. The network stays paused while developers finalize a restart plan, with one pending swap worth 115,654.41 USDT still held in Chainflip's vault.
Chainflip said in a Sept. 13 incident update that an attacker targeted its TRON USDT integration during the early hours of Sept. 12, prompting the cross-chain protocol to pause operations while it investigated. The team has since finalized a fix, but the network will remain paused until Monday at the earliest.
Altered memos triggered duplicate payouts
Chainflip reads swap instructions from transaction memos attached to TRON transfers, unlike most other supported blockchains, where instructions arrive through dedicated contract functions. According to the incident report, the attacker attached a new memo to a transaction that Chainflip validators had already signed. The protocol's systems then read the added memo as a separate swap instruction, and when that instruction appeared to fail, Chainflip issued a refund against a deposit that had already produced a payout.
The attacker repeated the method eight times over roughly ninety minutes, starting with small amounts before each later attempt grew to close to twice the size of the one before it. Only six of those attempts produced unauthorized payouts, together totaling 736,442.17 USDT. Chainflip attributed the flaw to its own processing of TRON memos and did not report any compromise of the TRON blockchain, the USDT smart contract, or Tether's reserve system.
Failed payments exposed the exploit
Chainflip detected the incident after later USDT payments began failing, and developers traced the failures back to the repeated processing of altered-memo deposits. The protocol suspended activity to check whether the weakness reached other assets or integrations, and its preliminary review found the exploit limited to TRON USDT, with remaining vault funds secure.
One legitimate user swap worth 115,654.41 USDT remains unpaid; Chainflip said those funds stay in its vault and can be released once the network restarts.
Compensation and recovery still pending
Chainflip said affected users would be made whole, though it had not selected or published a reimbursement method by Sept. 13, with several options still under review. The protocol has notified relevant parties about the stolen funds to help track or recover them as they move between addresses and services, but it did not name those parties or confirm whether any USDT had been frozen.
A complete technical report will follow once the restart plan is locked down and the network is operating securely, Chainflip said, without setting a publication deadline.
Source: crypto.news
Trading involves risk.
Risk Disclaimer
