Chainflip Crypto Hack: How Attackers Drain 736K USDT in 90 Minutes?

Chainflip Crypto Hack: Attackers Steal 736K USDT From TRON Integration

The latest Chainflip crypto hack news centers on a targeted attack against the protocol's TRON USDT integration, marking the first incident of its kind for the platform. 

Chainflip has confirmed that attackers found a way to manipulate transaction memos on TRON, tricking the system into releasing the same deposit multiple times. The breach has pushed the network into a temporary pause while engineers finalize a fix and prepare for a secure restart.

At a Glance

• Cross-chain protocol Chainflip confirmed its TRON USDT integration was exploited on Saturday.

• Attackers abused a flaw in how TRON transaction memos are processed, triggering repeated payouts on a single deposit.

• The exploit ran eight times in roughly 90 minutes, producing six unauthorized payments worth 736,442.17 USDT.

• A separate user swap worth 115,654.41 USDT is unpaid but remains safely locked in the Vault.

• Chainflip says all other funds are secure, a fix is ready, and the network could restart as soon as Monday.

How the Exploit Worked

Chainflip relies on memo fields attached to TRON transactions to read swap instructions, a method that differs from the dedicated contract functions used on most other supported chains. 

According to the protocol, the attacker discovered a way to attach a new memo to a transaction that Chainflip's validators had already signed. The system then read that memo as a distinct, failed swap and automatically issued a refund, effectively allowing the same underlying deposit to be paid out more than once. 

The attacker started with a small transaction to confirm the technique worked, then roughly doubled the amount with each subsequent attempt.

Source: Chainflip Official Post

Losses and Vault Status

The current analysis puts total losses at 736,442.17 USDT taken across six unauthorized payouts. A separate 115,654.41 USDT swap could not be completed and remains parked in the Vault rather than lost.

Timeline of the Attack

The exploit unfolded in the early hours of Saturday and lasted about an hour and a half from start to finish. The attacker tested the vulnerability with a small transaction before scaling up, roughly doubling the size on each of the eight attempts.

Chainflip's team eventually noticed that subsequent USDT payouts were failing, which prompted an internal investigation. Once the pattern was confirmed, the network was paused, and the security response began, culminating in the current effort to lock down a full restart plan.

The Pending 115K USDT Swap Explained

Not every unusual transaction from this incident represents a loss. One user's swap request for 115,654.41 USDT could not be processed once the exploit was detected and the system froze further payouts. 

Chainflip has clarified that this amount is separate from the stolen funds and is still sitting securely in the Vault. The protocol expects this pending swap to be resolved once operations resume.

Source: Wu Blockchain 

Security Fix and Network Pause

Chainflip paused its network to stop any further exploitation while its engineers worked through the root cause. The company says the fix for the underlying vulnerability has already been finalized, though the exact restart process still needs additional work to avoid complications. 

The team has also reportedly flagged the exploited funds with relevant industry parties in hopes of recovering a portion of the stolen assets as they move across the crypto news ecosystem.

Will Users Get Their Money Back?

It has stated that impacted users will be made whole, though the exact compensation mechanism is still being finalized internally. The company has framed the incident as fully recoverable, even as it continues evaluating the best path to reimburse affected users and pursue recovery of stolen assets. A complete technical report is expected once the restart plan is locked in.

Wider Security Implications

It described this breach as its first significant security event resulting in a loss of Vault funds, underscoring how transaction-processing logic on individual chains, like TRON's memo system, can become a weak point even in mature cross-chain infrastructure. 

The company also pointed to a broader industry trend of increasingly sophisticated attack tooling and said it plans to strengthen its own use of security tooling to catch issues proactively going forward.

Chainflip Price Today: September 14, 2026

Chainflip token price (FLIP) is at $0.3279, up 1.4% over 24 hours. The FLIP Token Market cap is $28.92M with 24h trading volume of $ 57,935.8.

Source: Coingecko Data

Conclusion

This crypto hack news highlights how a narrow, chain-specific quirk in memo handling can be leveraged into a costly exploit. With 736,442.17 USDT confirmed lost and another 115,654.41 USDT safely held pending restart, The near-term priorities are clear: finalize the fix, resume operations securely, and compensate affected users. A full incident report is expected in the coming days.

Disclaimer: This article is for informational purposes only and does not constitute financial, investment, or legal advice. Cryptocurrency markets and protocols carry significant risk, including the risk of hacks, exploits, and total loss of funds. Always conduct your own research and consult a qualified professional before making financial decisions.