Three crypto projects lost more than $11M combined in a single day of attacks on September 24. Payy Network's Ethereum bridge was drained of $1.8M, Duelbits lost around $7M to a likely private-key compromise, and the Meter network saw $2.3M in unbacked tokens minted and sold. The same day, Bitget separately reported about $351.6M in unauthorized transfers.
Payy Network and Duelbits lose almost $9M combined
Attackers hit Payy Network first, compromising its Ethereum bridge and prompting the team to halt the network. Onchain researcher Specter traced the attacker's funds to the privacy protocol Railgun, then found the attacker had swapped the stolen $1.8M in USDC for Ethereum. Payy Network later confirmed the bridge's balance was completely drained, affecting non-custodial deposits from Payy Network and Payy Wallet users.
The attacker then turned to crypto gambling platform Duelbits. PeckShield first put the losses at $4.3M, but Specter found more affected addresses on the Bitcoin and Solana networks and revised the estimate to $5.9M. A Duelbits co-founder eventually reported losses of around $7M, most likely tied to a compromised private key. Duelbits suffered a similar attack in 2024, losing $4.6M in an incident CertiK also linked to a leaked private key.
Meter's block-verification flaw mints $2.3M in fake tokens
Meter.io, an EVM blockchain, was the third target. Rather than draining existing reserves, the attacker exploited a flaw in block verification to mint new tokens out of nothing. Blockaid estimated the attacker created about $2.3M in assets and sold them through the decentralized exchange PancakeSwap.
That sale sent Meter-related tokens sharply lower: MTR lost nearly 80% of its value, while MTRG fell by about 75%. The Meter team said it preserved the network's state but has not yet determined how to fully restore it. Meter previously lost about $4.4M to a bridge exploit in 2022.
Bitget reports a much larger incident the same day
These three hacks coincided with a separate, larger incident at Bitget, which reported unauthorized asset transfers totaling about $351.6M from a limited number of wallets. Bitget suspended withdrawals while it ran security checks, though trading and deposits continued normally and user balances displayed correctly. The exchange is still investigating the incident and tracing the movement of the funds.
Source: Cryptonews
Trading involves risk.
Risk Disclaimer
