Cross-chain protocol Chainflip said it suffered an attack targeting Tron USDT, with 736,442.17 USDT confirmed stolen through six unauthorized payments. The protocol also said another 115,654.41 USDT in user swaps remains in the vault after payment failures, while all other funds were unaffected. According to Chainflip, the attacker exploited a flaw tied to Tron transaction memos by appending a custom memo to validator-signed transactions. That caused the system to treat the same deposit as a separate swap and issue another refund, leading to repeated payouts. Chainflip said the attacker carried out eight operations over roughly 90 minutes and increased the amounts over time. The team said a fix has already been completed, stolen funds have been flagged with relevant entities in an attempt to recover them, operations are expected to resume as early as Monday, and affected users will be made whole.
Cross-chain protocol Chainflip said an attack targeting Tron USDT took place yesterday. The protocol said 736,442.17 USDT was stolen through six unauthorized payments. Another 115,654.41 USDT tied to user swaps remains in the vault after payment failures, while all other funds were unaffected.
How the exploit worked
According to Chainflip, the attacker abused a flaw in the Tron transaction memo mechanism. By attaching a custom memo to transactions that validators had already signed, the attacker caused the system to recognize the same deposit as a separate swap and issue another refund, which led to repeated payouts.
Eight operations in about 90 minutes
Chainflip said the attacker carried out eight operations over roughly 90 minutes and gradually increased the amount involved.
Fix completed, restart expected as early as Monday
The protocol said it has completed a fix and has flagged the stolen funds with relevant entities in an attempt to recover them. Chainflip added that it expects to resume operations as early as Monday and will cover losses for affected users.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
