Payy Ethereum bridge: ~$1.92M USDC emptied via verifyRollup batches
83M then ~$90k), nearly emptying the bridge. Funds from the first batch were largely swapped to ETH. Payy paused deposits, withdrawals, transfers, and cards.
A later team note rules out a compromised key, social engineering, or off-chain infra exploit pending audit validation; repayment details were not yet public. Same-day cluster with Duelbits and Meter.
Research snapshot from Unchained and Payy posts.
369 take
A bridge that posts rollup batches can empty deposits even when the team says the signing key was not stolen.
Pulse lesson for Omnibridge-class rails: ask who can post settle / finalize calls and what a bad batch can withdraw. Prefer paused bridges over rushing refill before the validated report is public.
Sources