Chainflip has suffered a significant security breach, losing 736,442.17 USDT through six unauthorized payouts after an attacker exploited its TRON transaction memo handling system. According to the protocol's September 13 incident update, the attack targeted its TRON USDT integration during the early hours of September 12. The attacker repeated the same deposit method eight times within approximately 90 minutes using altered transaction memos, with each later attempt being close to twice the size of the previous one. The protocol has finalized a fix but operations remain paused until Monday at the earliest while developers prepare the restart procedure.
The exploit targeted Chainflip's unique approach to TRON transaction memos, which the protocol uses to read swap instructions attached to transfers. Unlike most other supported blockchains where instructions come through dedicated contract functions, Chainflip's systems interpreted added memos as separate swap instructions. When the new instruction appeared to fail, the protocol issued a refund, causing Chainflip to pay against the same deposit for a second time. The attacker found a way to attach new memos to transactions that Chainflip validators had already signed, with only six of the eight attempts producing unauthorized payouts totaling 736,442.17 USDT. One legitimate user swap worth 115,654.41 USDT remains unpaid and remains in Chainflip's vault pending network restart.
Chainflip has committed to making affected users whole, though the protocol has not yet selected or published its reimbursement method by September 13. The team indicated several options remain under review, with the unpaid 115,654.41 USDT transaction not counted among the six unauthorized payouts. The protocol has notified relevant parties about the stolen funds in an effort to track or recover the proceeds as they move between addresses and services, though it did not disclose whether the attacker used centralized exchanges or confirm that any USDT had been frozen. Chainflip plans to begin covering user losses after it restarts safely, with no public statement from Tether or TRON concerning the incident as of publication.
The network pause prevents swaps from being completed while developers prepare the restart procedure. Chainflip described this as its first critical security event involving money taken from protocol vaults, with earlier operational problems not causing comparable losses. The protocol has not reported a separate loss for users whose transactions were interrupted by the shutdown. The network would remain paused until Monday at the earliest, making September 14 the earliest possible restoration date instead of a confirmed launch time. Before reopening, the team plans to finalize a technical restart plan designed to avoid further processing problems.
Once the system resumes, Chainflip expects to process the pending 115,654.41 USDT swap and begin handling compensation for users whose funds were paid to the attacker. The protocol has not disclosed whether validators will need new software, a coordinated upgrade or a governance vote before reopening. A complete technical report will follow after the restart plan is locked down and the network is operating securely, though the protocol has not announced a publication deadline for that report.
