Image Credit: Shutterstock
Chainflip says an attacker extracted 736,442.17 USDT through six unauthorized payouts after exploiting how its cross-chain protocol processed transaction memos on TRON. The network remains paused while the team finalizes a restart plan and prepares to compensate affected users.
One legitimate swap worth 115,654.41 USDT is still pending inside Chainflip’s vault. The protocol says those funds remain secure and can be released once operations resume.
Added Memos Caused the Same Deposits to be Paid Twice
Chainflip reads swap instructions from memos attached to TRON transactions. On most of its other supported chains, those instructions are handled through dedicated contract functions instead.
The attacker found a way to append a new memo to a transaction that Chainflip validators had already signed. Chainflip’s systems interpreted the altered transaction as a separate failed swap and issued a refund even though the original deposit had already produced a payout.
The attacker tested the method eight times over roughly 90 minutes. Chainflip said the attempts started with smaller amounts before roughly doubling in size, with six producing unauthorized payouts totaling 736,442.17 USDT.
Failed USDT Payouts Exposed the TRON Exploit
Chainflip detected the exploit after later USDT payouts began failing. The team then traced the problem to the TRON memo-processing path and paused the network while reviewing the affected code.
The protocol said the remaining vault funds were unaffected. It has also flagged the stolen assets with relevant parties in an effort to recover proceeds as they move through the crypto market.
Network Remains Paused With Compensation Terms Pending
Chainflip says the underlying fix has been worked out, but the procedure for restarting the network still requires further preparation. Its Sept. 13 update said operations would remain paused until Sept. 15 at the earliest.
Affected users will be made whole, although Chainflip has not published the reimbursement mechanism or payment timetable.
The protocol also plans to release a fuller technical report after the restart plan is finalized, and the network returns to operation.
