DeFi hack attack: Three exploits snatch $11M in a single day

Crypto and DeFi projects continue to be hacked at a dizzying pace, and few days in recent weeks have been incident-free.

That said, Thursday was a particularly busy day, with three projects hit for a total of more than $11 million worth of crypto.

By the end of play, Payy Network had lost $1.8 million, Duelbits $7 million, and Meter $2.3 million.

The bridge connecting Payy Network, a rollup which offers on-chain payroll/treasury services, and Ethereum was first to be hit.

Pseudonymous on-chain investigator Specter first flagged suspicious withdrawals in a message to its Telegram group. Funded via privacy protocol Railgun, the attacker swapped $1.8 million of USDC for ETH.

The firm later confirmed the exploit, which drained the entire balance of its bridge, and paused all operations. It then clarified that the funds were “users’ non-custodial deposits to Payy Network/Payy Wallet,” but is yet to disclose the cause of the loss.

Today at 4:21 UTC Payy’s bridge contract on Ethereum was exploited and drained of its full balance.

Investigation is ongoing and we are following incident response guidelines.

While we investigate, all Payy Network transactions are paused including deposits, withdrawals,…

Read more: Across, Allbridge, TeleSwap lost $5.7M to bridge hacks in past week

Crypto casino and sports betting platform Duelbits was next up in a suspected private key compromise.

The estimated losses stacked up from blockchain security auditor PeckShield’s first tally of $4.3 million. Specter upped the ante to $4.9 million and then $5.9 million after identifying affected addresses on Bitcoin and Solana.

Duelbits’ own co-founder put the final number at approximately $7 million.

Confirming a ~$7M hack. Still investigating exactly what happened and how.

Until we have clarity, Duelbits stays offline. User funds are safe.

Next steps: finish the investigation, re-top hot wallets, and bring Duelbits back online, launch Duelbits 2.0.

I'll keep posting… https://t.co/V4Zl4St31I

Read more: $2M stolen in triple attack on Fetch.ai, NuNet, and SingularityNET

The project was previously hacked for $4.6 million in 2024. At the time, auditor CertiK also suspected the loss to be due to a private key compromise.

EVM blockchain Meter.io also fell victim to a bridge attack, but this time, unbacked tokens were minted instead of existing deposits being drained.

Addressing the incident via X, the team pointed to a “block validation flaw” and informed users that “we’ve preserved the chain state. The recovery method is still to be decided.”

1/
Security incident on Meter mainnet

On Sep 23 at 21:14 UTC, an attacker exploited a block validation flaw to mint unbacked MTR and MTRG, dump them on DEXs, and bridge funds out.

Mainnet and the bridge are paused. Please stop all activity on Meter.

Tokens worth a reported $2.3 million were minted out of thin air before being dumped on the PancakeSwap decentralized exchange.

The sales crashed the price of both MTR and MTRG tokens, which are down almost 80% and 75%, respectively. 

Meter has also been hacked before, for $4.4 million back in 2022, in what was also a bridge hack.

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.

The post DeFi hack attack: Three exploits snatch $11M in a single day appeared first on Protos.