Key Takeaways:
- Chainflip suffered six unauthorized withdrawals for a total loss of 736,442.17 USDT due to an issue with its TRON USDT transaction processing.
- The attacker tried it eight times over about 90 minutes, escalating the amounts used.
- Chainflip has halted its network and ensured that unaffected funds were safeguarded and will be fully reimbursed to the impacted users.
After disclosing a vulnerability to his TRON USDT integration, Chainflip found over USDT 736,000 was withdrawn from their vaults without permission. The cross-chain protocol has now pivoted to deploy a fix, resume safe operations and recoup some crypto assets.
An update on yesterday’s exploit affecting Tron USDT.
736,442.17 USDT was taken. All other funds are unaffected and secure, and impacted users will be made whole.
The network stays paused while we finalise the fix and the restart plan.
Full update: https://t.co/LTWSqLBOn3
— CHAINFLIP (@Chainflip) September 13, 2026
TRON USDT Flaw Enabled Double Payouts
The flaw actually pertains to how Chainflip handles transaction memos that are added to TRON transfers.
Craft instructions on TRON with memos, unlike many supported blockchains, in which the instructions are performed with dedicated functions in the contract.
The attacker found a way to add their own memo to a transaction that already had its validators’ signatures, Chainflip said. Chainflip’s system didn’t realize that the underlying deposit had already been processed but let that added memo go through as a new swap request.
The resulting sequence was actually a double trigger of the same deposit.
The attacker tried it out on smaller volume recruits before building up to larger ones. The hacking session lasted about 90 minutes and the hacker arithmetically doubled each hit, Chainflip said.
The total number of attempts is 8, and 6 of them were successful with the payout of 736,442.17 USDT.
Read More: BounceBit Shuts Down Layer 1 after An Authorization Exploit
One More Swap Remains Locked in the Vault
There is a loose user transaction of 115,654.41 USDT. The money was not stolen, the firm said, and remains in its vault.
The amount is also not a part of the 736,442.17 USDT loss. The protocol will handle the swap when the network is safely restarted. Other funds were unaffected and safe, according to the initial investigation by Chainflip.
Chainflip Pauses Network After $736K Loss
The protocol identified the issue when following payouts of USDT started to fail. Transaction activity was then explored and irregular deposits were noticed with duplicate processing through altered memos by the developers.
Since then, Chainflip has halted its network operations and is working on the technical fix and restart procedure. The issue is that the fix is already designed, but further steps are required to make sure the reopening has no other risks created, the team said.
The protocol calls for the network to be paused until at least Monday, but this is not a definitive and unconfirmed time.
Chainflip also noted its marking off the money of the victims as it works to identify and retrieve the stolen assets as they are spread across the crypto ecosystem.
Chainflip has pledged to repay those affected, though it hasn’t specified how. The team is still considering several options before it decides how losses will be filled. The compensation process will proceed when the network is securely restored.
Read More: Liquid Network Restarts Blocks After $320M Bitcoin Exploit, Pegs Still Frozen
