Payy Network halts operations after $1.92M USDC exploit drains Ethereum rollup

Payy Network shut down its entire payments platform on September 24 after an attacker exploited a vulnerability in its Ethereum rollup contract and walked away with roughly $1.83 million in USDC. Deposits, withdrawals, transfers, and card transactions all went dark as the team scrambled to contain the damage.

The exploit hit at 04:21 UTC, buried inside a malicious verifyRollup transaction confirmed at block 26044909.

What the attacker actually did

Payy is built around a privacy-first stablecoin payments model, running on an Ethereum-based rollup. The rollup contract is effectively the bridge between what happens on Payy’s network and what gets settled on Ethereum mainnet, and that bridge is where the attacker found their opening.

By crafting a transaction that passed through the verifyRollup function, the exploiter was able to extract USDC that should have remained locked in the contract.

Blockchain investigation firm Specter Investigation traced the stolen funds through the Railgun privacy protocol, where the USDC was converted into approximately 683 ETH and then fanned out across multiple addresses.

Payy confirmed the attack publicly and said all network operations were suspended while the team works with law enforcement and cybersecurity professionals. No timeline for resuming services has been announced.

This is not Payy’s first security scare in 2026

What makes this breach harder to dismiss as a fluke is that Payy already dealt with a serious vulnerability earlier this year. In June 2026, the project disclosed a critical flaw in its zk-circuit logic, the cryptographic layer responsible for generating the zero-knowledge proofs that underpin the platform’s privacy guarantees.

That flaw had allowed for the potential creation of forged burn messages, meaning an attacker could theoretically signal that tokens had been destroyed when they hadn’t been. The team patched it in version 1.3.0 before any funds were lost.

Why rollup bridges keep ending up in the headlines

Payy’s case follows a familiar pattern: a project builds a sophisticated privacy architecture, the cryptographic layer holds, but the surrounding infrastructure fails. Zero-knowledge proofs are exceptionally hard to break mathematically. The contracts that wrap around them are not always written to the same standard.

What users and investors are watching now

The immediate concern for Payy users is straightforward: funds are frozen, the network is dark, and the company has not given a restart date.

Payy has not indicated whether affected users will be made whole. In past DeFi exploits, outcomes have ranged from full reimbursement funded by treasury reserves to total losses for users, depending on the protocol’s financial position and governance decisions. Payy has not yet disclosed which category this incident falls into.

Security audits, which Payy had clearly invested in given the June patch, are necessary but not sufficient. The June vulnerability was found and fixed before exploitation. The September exploit suggests either a separate attack surface was missed or the fix introduced new complexity that created new risk.