Payy Network exploit analysis

On 24 September 2026, a bridge belonging to Payy Network was fully drained of funds. The stablecoin infrastructure company disclosed the loss at $1.8 million. Payy later added that the theft was "NOT a compromised key, social engineering or exploit of our off-chain infrastructure", but stopped short of naming the actual vulnerability. The post-exploit statement said the stolen assets were "users' non-custodial deposits to Payy Network / Payy Wallet", a phrasing that sits awkwardly against the project's marketing of self-custody. The team has halted all activity on Payy Network since the attack.

The mechanism is not public. Payy has not published a postmortem, an on-chain trace, or a root-cause analysis as far as the available reporting shows. What the company has done is enumerate what the attack was not: not a private key compromise, not social engineering, not an off-chain infrastructure bug. By process of elimination the attacker reached the bridge contract through some interaction with its on-chain logic, and the contract's design allowed complete drainage. The fact that the bridge was drained fully, rather than partially, suggests an authority-like failure mode, where one transaction sequence let an outside account move the entire balance.

The figure is the only number Payy has stated, and to avoid repetition with the page above it is enough to note that external outlets have not produced a contradicting figure. The news search for the period surrounding the incident turned up additional reporting from Crypto Briefing, The Defiant, and CryptoSlate, all carrying the same minimum range of figures and describing the same withdrawal event.

The response from Payy was limited to a halt. Three statements posted to the company's X account in the days after the attack described the loss, ruled out off-chain causes, and announced that operations had stopped. No recovery plan, no bounty for returned assets, and no timeline for a resumption have been published.

Compared with the other recent bridge incidents in the corpus, the Payy case sits alongside the Wanchain bridge exploit on Cardano, the Allbridge flash loan attack, and the Across Protocol relayer compromise as another example of bridge contracts continuing to be a productive target through 2026. The same year saw the Across relayer loss at $3.35 million in July, the Allbridge flash loan drain at $1.66 million in the same week, the Wanchain-Midnight loss at more than $9 million, and the Coinsbuy exchange drain at $8 million in August. Payy's loss is at the lower end of that band, but its classification is harder: the company's own statement rules out the most common bridge failure modes without naming the one that applied. The bridge has been frozen, so any further loss from the same vector has been prevented.