Three Heists, One Day: Crypto's $11M Bad Hair Day ✂️

Three crypto projects were attacked on September 24, with combined losses exceeding $11M, hitting an Ethereum payroll bridge, a crypto gambling platform and a network whose token contract was exploited to mint unbacked supply. Attackers drained roughly $1.8M from Payy Network, stole about $7M from Duelbits, and minted $2.3M in unbacked tokens on the Meter network, according to on-chain researcher Specter and blockchain security firm PeckShield. The three incidents targeted different parts of crypto infrastructure, ranging from cross-chain bridges to private keys, and two of the affected projects had previously suffered major hacks.

Payy Network, which provides on-chain payroll and treasury management services, was the first to report an attack. Specter identified suspicious transactions originating from the Payy Network bridge, with the attacker initially acquiring funds through the privacy protocol Railgun before swapping the stolen $1.8M in USDC for $ETH. Payy Network later confirmed that the attacker had completely drained the bridge's balance, stating that the funds involved were non-custodial deposits belonging to Payy Network and Payy Wallet users, though the team has not disclosed the exact cause of the exploit. The Payy Network team paused the network in response.

The attacker then moved on to the cryptocurrency gambling and betting platform Duelbits. PeckShield initially estimated the losses at $4.3M, but Specter later identified additional affected addresses on the $BTC and Solana networks, revising the estimate first to $4.9M and then to $5.9M. A Duelbits co-founder eventually reported losses of around $7M, most likely due to a compromised private key. In a statement, the co-founder wrote: "Confirming a ~$7M hack. Still investigating exactly what happened and how. Until we have clarity, Duelbits stays offline. User funds are safe. Next steps: finish the investigation, re-top hot wallets, and bring Duelbits back online, launch Duelbits 2.0." Duelbits suffered a previous attack in 2024 that resulted in a $4.6M loss, which CertiK also linked to a potential private key leak.

The third incident involved the Meter network, where an attacker minted $2.3M in unbacked tokens, a different attack vector from the bridge and private key exploits seen in the other two cases. Details on the Meter exploit mechanism were disclosed by the network's team and cited by the same security researchers tracking the day's incidents.