2026-09-24 · record inc_0010 · updated 2026-10-19
Payy: a forged zero-knowledge proof accepted by the bridge verifier
Payy's bridge released about 1.92 million USDC against burns that never happened after its Noir and Barretenberg verifier accepted an invalid proof.
Payy
EthereumComponent: Rollup bridge contract, Noir/Barretenberg verifier
Event: Official statementRoot cause: Official statementLoss: Official statement
Current status
Network paused; claims process promised.
Timeline
- 2026-09-24 04:21 UTCFirst payout of 1.83M USDC, per PublicAML.
- 2026-09-24 09:30 UTCSecond payout of 90,202 USDC.
- 2026-09-29Payy promises a claims process.
Root cause
Per Payy, an invalid burn proof was accepted by the deployed verifier. Certora attributes it to a missing start-at-zero rule in a Barretenberg sub-protocol, fixed upstream in July.
Basis: official post-mortem · verified by us against that source
Classes: Bridge and cross-chain verification
Impact: loss and recovery
Users' deposits held in the bridge contract. Network paused.
Reported loss
$1.92M
USD basis: Payy: 1,828,589.38 plus 90,202.82 USDC.
Recovered or returned
Unknown
No recovery reported; 90,202 USDC was unmoved when last checked by PublicAML.
Loss and recovery are separate figures. They are never netted, and amounts in different currencies are never added together.
Addresses and transactions
No addresses or transaction hashes have been verified for this record. We do not publish unverified hashes.
Public PoC metadata
No public PoC or reproduction entry is recorded for this incident.
Remediation and defensive indicators
- Network paused. Claims process promised, not yet published. (reported)
Defensive lessons from the class
- Add an independent solvency check outside the minting path.
- Cap mints and withdrawals per period.
Sources
Official post-mortem
Payy: September 24th incident, remediation process and post-mortem
Published 2026-09-29 · retrieved 2026-10-19
Independent analysis
Certora: The Payy exploit, a forged ZK proof attack
retrieved 2026-10-19
Independent analysis
PublicAML: Payy Network hack, money trail
retrieved 2026-10-19
Independent analysis
Foothold: Payy exploit, fix public 73 days
retrieved 2026-10-19
- UNCX Vesting V2: share records and token balance made to disagreeSame chain: Ethereum
- Symbiosis Bitcoin Bridge: 46.1 billion unbacked syBTC from a 330-satoshi depositShared class: Bridge and cross-chain verification
- Limit Break Payment Processor V2: forged sender through a trusted forwarderSame chain: Ethereum
Read the full written analysis
Method, uncertainty and corrections
Still unknown
- How the proof was built
- Whether the verifier was rebuilt
- Claims timing
Where sources disagree
- Some outlets quote $1.83M, covering only the first payout.
Written by ThreatWire editorial. Facts attributed to the sources listed; figures are estimates and not independently verified unless marked on-chain. Published 2026-10-19, last updated 2026-10-19. Figures are estimates from public post-mortems and named analysts; not independently verified unless marked as confirmed on-chain.
No corrections recorded since publication.