Payy bridge exploit freezes crypto cards, and no balances remain safe

Payy has frozen its stablecoin payment network, including card transactions, after saying its Ethereum bridge contract was exploited and drained on Sept. 24.

Its announcement covers deposits, withdrawals, transfers, and card purchases, leaving the ordinary ways to move or spend funds through Payy unavailable while the company investigates.

Payy’s statement puts the bridge incident at 4:21 a.m. UTC. It said all Payy Network transactions were paused during the investigation and promised further updates. Because the pause includes the card, the interruption extends beyond stablecoin transfers and into purchases made through the app.

A transaction on Ethereum occurred at block 26044909 at 4:21:23 a.m. UTC in which 1,832,149.4681 USDC left a Payy rollup contract. The company’s statement did not specify a USDC amount or identify a transaction hash, so the reported transfer measures one contract outflow while the total scope remains open.

A fuller loss figure depends on Payy’s accounting of the bridge beyond the movement visible in that single reported transaction.

Payy’s customer exposure remains unclear

Payy’s description of the bridge being drained of its full balance refers to that contract.

The Sept. 24 statement supplied no breakdown of the drained balance or a figure for customer losses, and it also gave no technical cause for the exploit.

The operational effect is more immediate. During the pause, users cannot deposit or withdraw on Payy Network, send transfers, or complete card transactions through the service. That includes both moving stablecoins and spending them through the card.

The company did not say how many users had active balances or attempted a payment during the interruption, so its announcement gives no measured count of people affected.

Payy said it was following incident response guidelines and would publish updates. The questions now are when each transaction function will return and whether the bridge loss affects customer balances. Its initial announcement gave neither a restoration timetable nor a customer-loss figure.

For users, the service freeze is the confirmed consequence today, while the financial exposure remains to be determined.