Triple exploit drains over $11 million in a single day

Thursday emerged as an unusually destructive day for the cryptocurrency sector, as malicious actors executed three separate exploits resulting in more than $11 million in cumulative digital asset losses. The incidents affected a diverse range of operations, including a payroll service, a digital casino, and a blockchain network, highlighting ongoing vulnerabilities across the ecosystem.

The first incident struck the Ethereum bridge of the Payy Network, a rollup offering on-chain treasury and payroll services. According to reports, the protocol suffered a complete drain of its bridge balance, totaling $1.8 million. Suspicious withdrawal activity was initially detected and shared in a Telegram group by a pseudonymous on-chain investigator known as Specter.

The attacker utilized the privacy protocol Railgun to swap the $1.8 million in USDC for ETH. Following the breach, operators paused all platform activities and acknowledged the exploit. While the exact technical cause remains undisclosed, the team clarified that the compromised assets were “users’ non-custodial deposits to Payy Network/Payy Wallet.”

Repeated security failures

Shortly after, a digital sports betting and crypto casino platform suffered an even larger breach. Duelbits experienced a suspected private key compromise that ultimately cost the operation approximately $7 million. Initial assessments from blockchain security auditor PeckShield placed the damage at $4.3 million.

The scope of the incident quickly expanded as investigators tracked the funds. Specter identified additional compromised addresses across the Solana and Bitcoin networks, pushing the estimated damage to $4.9 million and subsequently $5.9 million. A co-founder of the platform later established the final loss figure at around the $7 million mark. This marks the second major breach for the betting platform this year, following a $4.6 million exploit in 2024 that auditor CertiK also attributed to a suspected private key compromise.

Tokens minted out of thin air

The final attack of the day targeted Meter.io, an EVM blockchain. Unlike standard bridge exploits where existing user deposits are siphoned away, this attacker successfully minted unbacked tokens. The unauthorized assets, valued at a reported $2.3 million, were rapidly liquidated on the PancakeSwap decentralized exchange.

The massive sell-off had an immediate and severe market impact. The price of the network's native MTR token plummeted by almost 80%, while its MTRG token experienced a 75% drop. Addressing the situation on X, the development team attributed the breach to a “block validation flaw.”

Despite the severe market reaction, the protocol's operators attempted to reassure users regarding the integrity of the network itself, stating, “we’ve preserved the chain state. The recovery method is still to be decided.” The incident mirrors past struggles for the network, which previously lost $4.4 million to a separate bridge hack in 2022.