Payy has confirmed that attackers exploited its Ethereum bridge contract, draining the bridge’s entire balance in an incident estimated at about $1.83 million.
The company halted Payy Network activity and disabled wallet functionality while it investigates the breach and attempts to recover the stolen assets.
The exploit occurred at 4:21 UTC on September 24; the affected component was Payy’s bridge contract on Ethereum, a smart contract designed to support transfers between Ethereum and the Payy Network.
Hackers Drain $1.83 Million From Payy Ethereum Bridge
Payy said the attacker emptied the contract’s full balance, turning the cross-chain bridge into the central point of failure for the attack. Payy later clarified that the stolen assets were users’ non-custodial deposits held in connection with Payy Network and Payy Wallet services.
The company did not disclose the technical root cause, the vulnerable function, the attacker’s transaction method, or whether the exploit involved an access-control flaw, compromised signing authority, accounting error, or smart-contract logic vulnerability.
As part of its immediate containment actions, Payy paused all Payy Network transactions. The suspension affects deposits, withdrawals, transfers, and card transactions, preventing users from moving funds through the affected ecosystem while the investigation remains active. The company also paused Payy Wallet functionality.
Halting activity is a standard incident-response measure for bridge compromises. It limits the risk of additional loss, preserves transaction evidence for investigators, and prevents affected contracts or associated services from continuing to process potentially unsafe requests.
In bridge incidents, operators must also determine whether the compromise is isolated to a single contract or whether related deployment keys, backend systems, relayers, and wallet integrations could be exposed.
Payy said it had notified law enforcement, cryptocurrency exchanges, blockchain analytics firms, and other relevant parties about attacker-controlled addresses.
This step can help exchanges identify and freeze assets if the attacker attempts to convert, bridge, swap, or deposit the stolen funds into centralized trading platforms.
Payy stated that it is working with multiple incident-response organizations and conducting root-cause analysis alongside recovery efforts. However, no confirmed exploit path has been published as of this writing.
The case highlights the persistent security risks associated with Ethereum bridges, which often hold significant pooled liquidity and rely on complex smart-contract logic, cross-chain message validation, privileged administrative functions, or external validator infrastructure.
A flaw in any of those controls can allow attackers to mint unbacked assets, bypass withdrawal restrictions, or drain locked collateral. For Payy users, the incident creates uncertainty about recovering deposits and the timeline for restoring network operations.
The platform has not yet announced a reimbursement plan, eligibility criteria, snapshot date, or a schedule for resuming deposits, withdrawals, transfers, or card services.
Users should avoid unofficial recovery links, wallet-support messages, or token-swap offers, as attackers often exploit public crypto incidents through phishing campaigns and impersonation attempts.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
