Cross-chain protocol Chainflip lost 736,442.17 USDT following an exploit in its TRON USDT integration. The incident, which occurred in the early hours of September 12, 2026, resulted in six unauthorized payouts transferred to the attacker’s wallet. The development team immediately suspended all cross-chain network operations to investigate the security flaw and prepare a technical fix.
Double Payout Trick Through Memo Manipulation
The vulnerability stemmed from the way Chainflip processes memo data on TRON network transactions. The attacker appended a new memo to a transaction that had already received signature verification from validators. This inserted data caused Chainflip’s internal system to detect it as a new swap instruction.
Because the fake instruction appeared to fail processing, the protocol issued a refund command. However, the payout for the original deposit had already been executed. As a result, the system disbursed double funds for the same deposit.
The exploit lasted for about 90 minutes. The attacker repeated the memo manipulation up to eight times, starting with a small initial amount and nearly doubling the withdrawal sum on each subsequent attempt. Out of the eight attempts, six forced the protocol to release unauthorized payouts.
Not TRON or Tether’s Fault
Chainflip emphasized that no other funds were lost beyond the initial loss figure. They explained that the root cause was purely in Chainflip’s proprietary TRON memo processing code. The security flaw was not related to the TRON blockchain base layer, USDT smart contract code, or Tether’s liquidity reserve system.
The network suspension left one legitimate user swap worth 115,654.41 USDT currently unpaid. Developers assured that the user’s funds are safely stored in the protocol’s vault and will be released to the destination wallet once the system is back online.
No Independent Confirmation Yet
The technical report regarding the outflow of funds comes entirely from Chainflip’s internal team. As of September 13, no independent security assessment firm has released an official audit to confirm the full timeline of events.
Reported by crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
