Payy's bridge paid out $1.9M after its verifier accepted a forged proof

What happened

Payy is a privacy-focused payment network built as a rollup on Ethereum. People deposit USDC into a bridge contract, spend it privately inside the rollup, and can burn it there to withdraw on Ethereum. The bridge pays out when it is shown a valid zero-knowledge proof that the burn happened.

On 24 September 2026 it paid out when no burn had happened.

Payy's post-mortem says an attacker submitted an invalid burn proof and the deployed verifier accepted it. In two payouts the bridge sent about 1.92 million USDC to one wallet. Payy paused its network the same day.

What is confirmed

All of this is from Payy's incident page unless attributed otherwise. Times are UTC.

• The first burn released 1,828,589.378132 USDC even though, in Payy's words, "it appears that the transaction was invalid."
• A second burn of 1 USDC was paid early by a "burn substitutor", a service that fronts withdrawals and is repaid later, and was reimbursed afterwards. That second transaction released 90,202.820016 USDC to the same receiving wallet.
• Payy's early statement had already ruled out a private-key compromise and social engineering. The post-mortem points at "a proving-system vulnerability in the Noir/Barretenberg verifier, developed by Aztec."
• A fuller report is linked from the incident page.

From outside analysts

• Certora's reconstruction says the flaw was in one sub-protocol of the verifier that checks a running sum. A fix landed in Aztec's repository on 14 May 2026 and shipped in Barretenberg v5.0.0 on 13 July. Payy was still running a build from 30 October 2025.
• PublicAML traced the money. It says the first payout was swapped for about 683 ETH within minutes, split across three wallets, and put into Tornado Cash on 26 September. The second payout of 90,202 USDC had not moved as of its last check, and Circle had not frozen it.
• PublicAML also found that the attacker's wallet received a small amount of gas from Railgun on 22 September and deposited 5 USDC into the bridge twice, which it reads as a test.

How it worked

A zero-knowledge proof lets someone show that a statement is true without revealing why. A verifier is the code that checks that proof. If the verifier is wrong, a prover can show a "proof" of a lie and be believed.

According to Certora's reading of the public fix, one step in the verifier asks the prover to claim a total and to build a running column of values that should start at zero, add one number at a time and end at the claimed total. The weakness was that nothing forced the column to start at zero. That left a single degree of freedom to someone building a proof on purpose.

Payy has not published how the proof was built, and we are not describing it. The consequence is what matters. The bridge's only question was "is this proof valid?". Once the verifier said yes, nothing else stood in the way of the USDC. PublicAML's reading of the contract is that the payouts were sent by Payy's own operator as part of ordinary batches, so the transactions on Ethereum looked routine.

What is not known

• How exactly the attacker built the proof. It has not been published.
• Who the attacker is. PublicAML names no one and says its trace cannot identify the person behind the Railgun funding.
• Whether Payy has rebuilt its circuits and verifier on a release that contains the fix. Certora's last status note, dated 11 October, says neither Payy's page nor its X account said so.
• When users will get a claims process. Payy said on 29 September that one would follow in the coming days. As far as ThreatWire can tell from Payy's incident page, it has not been released.
• How much can still be frozen. Whether Circle ever froze the remaining 90,202 USDC is not public.

Where sources disagree

• The loss. Payy gives exact USDC amounts for the two payouts, which add up to about 1,918,792 USDC. Some outlets round to $1.83M, which covers only the first burn, and some to $1.9M or $1.92M.
• The cause. Payy writes cautiously ("it appears"). Certora is firmer and names the specific sub-protocol. The version history Certora cites is public, but we cannot confirm which build Payy ran from here.

Lessons

• Update proving-system dependencies like security software. A fix existed for 73 days before the attack, according to Certora.
• A verifier is a single point of failure. Add independent limits: caps per withdrawal, per hour and per day, and a delay on large amounts.
• Validate the inputs the proof does not cover. Certora notes the contract did not require the burn hash to be non-zero.
• Pin and review proof-system versions. Know which commit your verifier was built from, and watch the upstream security notes.
• A fast pause matters. Payy paused its network on the day, which limits further loss.

What users should do

If you held USDC in Payy, or used a Payy card, follow only Payy's official site and X account for the claims process. Payy says it will announce one. Do not enter seed phrases or connect a wallet to any "claim" page you reach through a message or a search ad.

Do not send funds to Payy's bridge address while the network is paused.

Sources: Payy's incident page, with analysis from Certora and on-chain tracing by PublicAML, neither of which is linked here. We have not checked the transactions ourselves.