At 4:21 UTC on September 24, an Ethereum address that had submitted 200 consecutive legitimate rollup batches to Payy's bridge contract called verifyRollup and withdrew 1,828,589 USDC. At 9:30 UTC, the same address returned and removed 90,202 USDC. The bridge now holds approximately 700 dollars. Payy's public statement rules out a compromised key. Evidence does not negotiate. The chain says the withdrawals originated from the protocol's designated batch submitter. The statement says no key was stolen. Both cannot be true unless the verification logic itself accepted what it should not have accepted.
Payy is a privacy-focused stablecoin payment network structured as an L2 rollup that settles to Ethereum. Users deposit USDC into a bridge contract operated by the network. The critical function is verifyRollup, which validates and finalizes batches submitted by an operator. On-chain analysis shows that the batch submitter address had been calling verifyRollup for nearly all of its transactions since late August. This is the same address that initiated the two theft transactions. Consequently, the attack was not performed by an unknown external contract or a newly deployed wallet. It was performed through the protocol's own operational identity. This is a single-trust-anchor design: one address holds the power to finalize state.
Scale matters. The stolen amount is $1.92 million, which is small in absolute industry terms. That is why the event has not triggered a market-wide repricing. But the scale of the balance is not the scale of the lesson. The attack pattern shows a patient, methodological actor. On September 22, the receiving address deposited 5 USDC and withdrew 5 USDC the same day. On September 23, it deposited 5 USDC again. On September 24, it executed the full drain. These micro-transactions are reconnaissance. They are test signals. An attacker who sends dust through a bridge to observe its behavior is not an insider who made a mistake. Pressure reveals the cracks in logic, and the crack appears in the withdrawal authorization path.
The central question is whether the batch submitter's private key was compromised or whether verifyRollup's validation logic can be satisfied without legitimate authorization. The two-stage withdrawal pattern strongly favors the second reading. The attacker first extracted 1,828,589 USDC, leaving 95,000 on the table. Five hours later it returned to extract 90,202 more, leaving only ~700. A holder of a stolen operator key could have withdrawn the entire balance in one call. The decision to return for the residual amount suggests a precise understanding of what each fabricated batch would allow. This is not the behavior of a thief in a hurry. It is the behavior of an exploiter who is reading the contract state. No public audit of the bridge was disclosed before the incident. The protocol's own risk framework treated verifyRollup as trusted infrastructure, not as a threat surface. In high-frequency financial contracts, an unverified state transition function is a liability. This is especially true when a single submitter holds the ability to write withdrawals. The audit engagement began only after the balance was drained.
Within eight minutes, the first tranche moved through UniswapX and was converted into approximately 683 ETH. By 5:39 UTC, the ETH was split across three wallets. This is a professional laundering sequence. UniswapX was deliberately chosen over a centralized exchange. That choice avoids withdrawal freezes. It avoids KYC triggers. It uses a public on-chain liquidity pool to transform a stablecoin into a harder-to-track asset. The disbursement into three wallets is a classic anti-tracing measure. During the ICO refund audits I performed in the 2018 bear market, I learned to separate two facts: the identity of the caller and the validity of the call. The signing key is not a proof of intent. It is an input to a verification function. If the function has a gap, the key's authority is decorative. History verifies what speculation cannot. The history here is immutable: the only caller was the batch submitter, and the only result was an emptied bridge.
Payy's response strategy is fast on action, slow on facts. The network was paused, the address was flagged to law enforcement, exchanges, and blockchain analytics firms, and an audit was commissioned. Yet the public statement has not disclosed the exact loss. It has not disclosed whether users will be compensated. It has not provided a restart date. It has instead declared that compromised keys and social engineering are ruled out. That declaration came before the audit was complete. This sequence is a preemptive framing. It redirects responsibility from internal key management toward an unknown technical root cause. If the final report identifies a logic flaw, the statement is incomplete. If it identifies key compromise, the statement is false. Silence is the strongest proof of truth. What users have instead is uncertainty.
The 'non-custodial' label deserves scrutiny. Users hold their own keys, but their funds were held by a bridge contract that could be triggered by a single operational address. Non-custodial custody does not eliminate contract-level risk. It only moves the threat surface from the wallet layer to the verification layer. The team's ability to halt the network and wallet also reveals a centralized governance structure. Availability is controlled by the team. The deposited balance was controlled by a verification function. The privacy positioning creates a third tension. A privacy-focused payment network saw its stolen funds swapped on the fully public UniswapX protocol. Transaction privacy is not the same as resistance to tracking. Complexity hides its own failures. A rollup bridge, a stablecoin deposit, and a privacy claim were layered onto one another. Only the verifyRollup function was ever tested under adversarial pressure.
One more point must remain isolated. On the same day, Bitget lost approximately $351.6 million in a separate incident. The two events are independent. They are easy to merge into a single 'bridge and exchange security season' narrative, but that merge obscures mechanics. Bitget was a hot wallet compromise at a centralized service. Payy was a settlement-function anomaly at a rollup bridge. One tests exchange custody practice. The other tests proof-validation logic. They are not evidence of a shared cause.
For Payy users, the rational assumption is total loss. No compensation promise exists. The second tranche of 90,202 USDC had not moved as of Friday afternoon, but the first tranche is already fungible. Do not deposit new funds into a bridge whose root cause remains undefined. Unless a third-party-verified report proves that the contract was patched and the trust assumption was changed, a restart simply invites a repeat.
For the industry, the lesson is structural. Any rollup bridge that grants a single batch-submitter address the power to settle batches must be audited for verification logic, not merely for key custody. The attack did not need to break encryption. It needed to feed a forged batch into a function that trusted its operator too deeply. Structure outlasts sentiment. The social trust in Payy is already damaged, but the underlying structure may still exist in similar projects. The question is not whether Payy recovers. The question is which other verifyRollup-style contracts are waiting for the same test.
