Payy cross-chain bridge has been hacked and its encrypted card frozen

Payy, the payment platform for stablecoin , announced on September 24 that its Ethereum and cross-chain bridge contracts had been hacked and emptied. The company immediately froze the entire payments network. At this time, all top-up , withdrawals, transfers and card consumption have been suspended, and users are no longer able to move or use funds through Payy in their usual ways, the company said it is investigating.

When the attack occurred and how much money was involved

Payy in its statement dated the cross-chain bridge event to 4:21 am Coordinated Universal Time (UTC). The data for on-chain shows that a transaction occurred at 4:21:23 on block 26044909 of Ethereum , with $1,832,149,4681 flowing from rollup contracts held by Payy, totaling approximately $18.3 million.

It should be noted that Payy's official statement does not specify the specific USDC amount, nor does it provide a transaction hash. The above figures are from a verifiable contract outflow record, and the overall loss size of the incident still depends on Payy settling all balances against this cross-chain bridge , as single transactions do not represent total losses.

What are the current impacts on users?

The suspension covers all types of transactions on the Payy Network. During the investigation, users were unable to make top-up withdrawals, initiate transfers or use a Payy card to complete their shopping cart. This means that the impact extends beyond the stablecoin transaction itself and extends into everyday payment scenarios within the application.

At the time of writing, Payy has not disclosed how many users have active balances or statistics on how many payment attempts were blocked during the suspension, so there is no precise figure for those affected. In addition, the statement neither explains the composition of stolen balances nor gives the amount of customer losses and does not explain the technical reasons for the attack.

What's next?

Payy said it was working with the incident response protocol and promised to release further updates. There are two key questions that remain unanswered at this time: when trading functions will be restored, no timetable for which has been given; and whether cross-chain bridge 's losses would affect users' balances, a financial loophole also without an answer.

The actual financial impact of the incident is yet to be disclosed by Payy. cross-chain bridge serves as a core infrastructure for Asset cross-chain , which has historically been attacked at high-throughput junctions, and balancing payment arrangements after such events are often what users need to focus on most.