Chainflip lost 736,442 USDT after an attacker exploited its TRON USDT integration, forcing the protocol to pause operations temporarily.
Chainflip lost 736,442.17 USDT after an attacker exploited its TRON USDT integration on September 12. The attacker made 6 unauthorized payouts before Chainflip halted the network.
Chainflip reported the incident on September 13, and developers are working on a fix. In the meantime, the network is being suspended as the team works on a restart plan.
Chainflip Loses 736,442 USDT Through Unauthorized Payouts
Chainflip said the attacker stole a total of 736,442.17 USDT through 6 unauthorized payouts. This is the amount extracted in the exploit.
An update on yesterday’s exploit affecting Tron USDT.
736,442.17 USDT was taken. All other funds are unaffected and secure, and impacted users will be made whole.
The network stays paused while we finalise the fix and the restart plan.
Full update: https://t.co/LTWSqLBOn3
— CHAINFLIP (@Chainflip) September 13, 2026
One legit user swap valued at 115,654.41 USDT is not paid separately. This loss does not include that amount of USDT.
Instead, the 115,654.41 USDT has been left in Chainflip’s vault as the network halted prior to finishing that swap. The money can be issued once the network has been restarted.
Related reading: TRON Targets Quantum-Resistant Upgrade by Year-End
Chainflip said it expects to make users affected by the theft whole. The protocol, however, still requires further analysis before deciding on the final recovery method.
The team has meanwhile notified the authorities of the stolen money. The action may help to retrieve some of the 736,442.17 USDT as they pass through the crypto networks.
Chainflip said the incident was its first significant loss from its vaults. As a result, the protocol will improve its internal processes following the attack.
How the Attacker Exploited Chainflip’s TRON System
Transaction memos are used to send swap instructions to TRON transactions in Chainflip. But other supported networks have dedicated contract functions for these instructions.
According to Chainflip, the attacker found a weakness involving TRON transaction memos. They added their own memo to a transaction that was already signed by Chainflip validators.
The added memo was then interpreted as another swap instruction. It declared the transaction a failure and refunded the amount automatically.
As a result, the same deposit received 2 payouts. The attacker used this technique 8 times in about 90 minutes.
Furthermore, the attacker began with small quantities to verify the technique. They then doubled the amount approximately each time they tried.
Chainflip found out about the problem when later USDT payouts started failing. Developers then dug in to the transactions and found the attack technique.
The incident highlights risks created by differences between blockchain integrations. So Chainflip needs to check its TRON transaction handling before it can resume operations.
Chainflip Prepares Fix Before Restarting Network
Developers have already worked out a patch for the vulnerability exploited, Chainflip said. However, the team needs additional work to complete a safe restart process.
In the meantime, the network will be paused while those preparations are being made. Chainflip said it could keep the business shut down until Sept. 14 at the latest.
The protocol also intends to release a full report once it has the technical restart plan. That report should be more detailed with regard to the exploit and response.
Once the network is back up and running, Chainflip will concentrate on the USDT 736,442 loss. The protocol said several options remain for recovering or replacing the stolen funds.
After the network restarts, the separate user swap of USDT can also be carried out, with a total amount of 115,654.41 USDT. Therefore, that amount should not be added to the reported exploit loss.
Chainflip also pointed to broader challenges in the crypto sector. The company cited more advanced AI tools as a component of the evolving threat landscape.
Be the first to comment