Payy bridge drain froze cards before the full loss was known

The freeze is total, but the bill is not yet itemized. Payy halted all network activity on Sept. 24 following a bridge exploit, stopping every function from card purchases to transfers. The company’s announcement confirmed the halt but left the total damage unquantified, offering no restoration timeline or customer loss figure.

On-chain records show a specific, identifiable outflow. In Ethereum block 26044909, recorded at 4:21:23 a.m. UTC, 1,832,149.4681 USDC left a Payy rollup contract. Payy stated that all Payy Network transactions were paused during the investigation, explicitly including deposits, withdrawals, transfers, and card purchases.

The reported transfer measures one contract outflow, but the full scope of the incident remains open. Payy’s public disclosure did not specify a USDC amount or identify a transaction hash, so the single transaction does not represent the entire drain. The company also gave no technical cause for the exploit and did not say how many users had active balances or attempted a payment during the interruption.

The April 2026 theft of approximately $292 million from KelpDAO’s LayerZero bridge by attackers linked to North Korea’s Lazarus Group, as detailed in Chainalysis’s "Inside the KelpDAO Bridge Exploit," provides a historical benchmark. According to CryptoSlate, Payy halted transfers, withdrawals, and card payments after a bridge exploit moved about $1.83 million in USDC from its Ethereum contract. However, CryptoSlate noted that "the company's statement did not specify a USDC amount or identify a transaction hash, so the reported transfer measures one contract outflow while the total scope remains open," leaving the full extent of the loss uncertain. The next Federal Reserve rate decision is on October 28, 2026.