Privacy Stablecoin Payment Network Payy Network's Ethereum Side Funds Abnormally Flow Out Approximately $1.8 Million USDC
The on-chain investigation group Specter Investigation has detected that approximately $1.8 million USDC has abnormally flowed out from the Ethereum side of the privacy stablecoin payment network Payy Network. The official confirmation later stated that the attacked contract was the Ethereum cross-chain/rollup bridging contract, from which the entire balance was transferred out. They have suspended deposits, withdrawals, transfers, and card payments, while also reporting the incident and engaging multiple emergency response agencies.
A transaction on Ethereum block 26044909 at 04:21:23 UTC called the contract function verifyrollup, transferring 1,832,149.4681 USDC from address 0x367c1eaf…85270, of which 1,828,589.3781 USDC entered 0xaa4985db…57e70. The Defiant reported the scale to be approximately $1.92 million; the funds were then exchanged for about 683 ETH, which were further split into three addresses, with the split amounts being approximately $534,000, $754,000, and $134,000 according to the Specter flowchart.
The attack's initial funds entered through the privacy protocol Railgun, and after the source was cut off, they were sent to the Payy contract. ReKtradar and others noted that the initiating transaction from 0x5343b904…d38 resembled an existing prover or operational key of Payy (high nonce, long gas charges), rather than a completely new attack address; within about 96 seconds, a large amount of USDC entered the EIP-7702 delegated account, was exchanged for approximately 683.38 ETH via Uniswap X routing, and then split into approximately 200/200/280 ETH. PeckShield also forwarded the same verifyrollup loan transaction.
Payy is positioned as a privacy stablecoin payment, with the bridging contract responsible for custody between rollup and Ethereum. The entire balance on this bridge was emptied, not every independent account within the user card organization. The official has not disclosed a compensation timeline, only stating that the investigation is proceeding according to emergency guidelines, with no set upgrade window.
Mechanically, what was sold was the USDC custody within the bridging contract, and what was bought were proofs or key permissions that could release batches through verifyrollup. The event was driven by the verification function being used to release funds in one go, rather than market price fluctuations. Funds were launched from Payy's custody through Railgun, exchanged via Uniswap, and entered the ETH reserves of three addresses; the beneficiary is the party controlling these three addresses, while the burden falls on Payy users who cannot redeem after the bridge's balance was emptied, as well as the project parties that have staked the privacy payment narrative on the same cross-chain contract. The stablecoin was first exchanged for ETH, indicating that the attacker sought a form of asset that is divisible and difficult for the issuer to directly freeze.
Source: Public Information
ABAB AI Insight
Payy has designed its product as "privacy stablecoin payment + card", but it still requires locking a certain amount of USDC on Ethereum, using rollup proofs to submit the state back to the mainnet. Verifyrollup was supposed to release funds only after verifying the legitimacy of the batch, but one call nearly emptied the custody, indicating that the verification conditions or signature permissions were tied to the same entry point for fund withdrawals. The initiating address resembles an operational prover rather than a random hacker, suggesting that the key or proof pipeline was reused rather than randomly colliding with the contract. Railgun is only responsible for initiating anonymity; the actual opening is the bridge.
The capital path is short and dense: Railgun provides funds → calls verifyrollup → USDC exits the bridge → Uniswap X exchanges for ETH → three addresses split the funds. Completing the exchange and split in 96 seconds was to leave the stablecoin form before the official suspension and issuer risk control. Suspending deposits and card payments effectively turns the payment network from "available dollar track" into a shutdown announcement. Law enforcement and emergency response have entered, and recovery depends on whether the three addresses continue to move funds, and whether Circle can intercept before the exchange is completed, the latter window has already passed.
This is analogous to multiple rollup bridge and "verification releases funds" vulnerabilities: Opt bridge, multi-signature bridge, and one-time emptying after proof keys are stolen, all demonstrate that L1 custody contracts have made correctness checks functions that can be satisfied by a single transaction. Privacy protocols here serve as the entry point for laundering, not the target of the hack. The industry stage still sees payment networks managing all reserves through a single bridge, rather than multi-signatures with delayed withdrawals and independent validators. Whoever separates verification from withdrawal rights can still conduct privacy payments; whoever combines proof keys and vaults will be emptied in the next verify.
Structural judgment belongs to the concentration of custody after a technical substitution failure. Pricing power lies in "who can make verifyrollup consider the batch valid". The mechanism is that privacy payments must have someone to manage the exchange reserves, which are placed in contracts accessible by a single verification function, making the privacy layer more convenient for attackers to initiate. The narrative of tokenized dollar payments ultimately depends on whether the bridge can be clarified by a single transaction.
ABAB News · Law of Cognition
If the verification function can release funds, the bridge is not a bridge, but an ATM.
The privacy protocol hides the starting point, but cannot hide the emptied vault.
The reserves of the payment network are priced before the payment slogan.