Three crypto projects were hit by separate exploits on Thursday, with combined losses topping $11 million, according to Protos. By the end of the day, Payy Network had lost $1.8 million, Duelbits about $7 million, and Meter.io roughly $2.3 million.
Three incidents in one day
Protos said hacks have continued at a rapid pace across crypto and DeFi in recent weeks, with few days passing without an incident. Thursday stood out because three different projects were hit within the same day.
Payy Network bridge drained
The first incident involved the bridge linking Payy Network and Ethereum. Payy Network is a rollup focused on on-chain payroll and treasury services.
Pseudonymous on-chain investigator Specter first flagged suspicious withdrawals in a Telegram message. The attacker, whose funds were routed through privacy protocol Railgun, swapped $1.8 million in USDC for ETH.
Payy later confirmed the exploit, saying the full balance of its bridge had been drained and all operations had been paused. The firm then said the stolen assets were 「users non-custodial deposits to Payy Network/Payy Wallet」, but it had not yet disclosed the cause of the loss.
In a post on X, Payy wrote: 「Today at 4:21 UTC Payy’s bridge contract on Ethereum was exploited and drained of its full balance. Investigation is ongoing and we are following incident response guidelines. While we investigate, all Payy Network transactions are paused including deposits, withdrawals, ...」
Duelbits loss estimate rose through the day
Duelbits, a crypto casino and sports betting platform, was hit next in what Protos described as a suspected private key compromise.
Blockchain security auditor PeckShield first estimated losses at $4.3 million. Specter later raised that figure to $4.9 million and then $5.9 million after identifying affected addresses on Bitcoin and Solana. Duelbits co-founder Joe eventually put the final number at about $7 million.
Joe said on X: 「Confirming a ~$7M hack. Still investigating exactly what happened and how. Until we have clarity, Duelbits stays offline. User funds are safe. Next steps: finish the investigation, re-top hot wallets, and bring Duelbits back online, launch Duelbits 2.0. I'll keep posting...」
Protos also noted that Duelbits had previously been hacked in 2024, when it lost $4.6 million. At that time, auditor CertiK also suspected a private key compromise.
Meter.io says flaw allowed unbacked token minting
Meter.io, an EVM blockchain, also suffered a bridge attack. In this case, existing deposits were not drained first. Instead, unbacked tokens were minted and then sold.
Addressing the incident on X, the team pointed to a 「block validation flaw」 and said, 「we ve preserved the chain state. The recovery method is still to be decided.」
According to the team, at 21:14 UTC on September 23, an attacker exploited the flaw to mint unbacked MTR and MTRG, dump them on decentralized exchanges, and bridge funds out. Meter said its mainnet and bridge were paused and told users to stop all activity on the network.
Protos reported that tokens worth about $2.3 million were minted out of thin air before being sold on PancakeSwap. The selling pushed MTR down almost 80% and MTRG down 75%.
Meter had also been hacked before. Protos said the project lost $4.4 million in a bridge hack in 2022.
More than $11 million lost across the three cases
Taken together, the three incidents left Payy Network, Duelbits, and Meter with losses of more than $11 million in a single day.