Pavlo Kot

Three crypto projects hacked in one day as losses top $11 million

Three crypto projects hacked in one day as losses top $11 million
Three crypto projects lose over $11M in one day

​Three crypto projects were attacked on September 24, suffering combined losses of more than $11 million. Attackers drained around $1.8 million from Payy Network, stole $7 million from Duelbits and minted $2.3 million in unbacked tokens on the Meter network.

The incidents affected different parts of crypto infrastructure, ranging from cross-chain bridges to private keys. Two of the three affected projects had already suffered major hacks in previous years.

Payy Network, which provides on-chain payroll and treasury management services, was the first to report an attack. Its bridge to Ethereum was compromised, prompting the team to completely halt the network.

Payy Network and Duelbits lose nearly $9 million

Onchain researcher Specter detected suspicious transactions from the Payy Network bridge. The attacker, who initially obtained funds through privacy protocol Railgun, swapped the stolen $1.8 million in USDC for Ethereum.

Payy Network later confirmed that the attacker had completely drained the bridge balance. The company said the funds were non-custodial deposits belonging to Payy Network and Payy Wallet users, but has not yet disclosed the cause of the exploit.

The next target was crypto gambling and betting platform Duelbits. PeckShield initially estimated losses at $4.3 million, before Specter identified additional affected addresses on the Bitcoin and Solana networks, raising the estimate first to $4.9 million and then to $5.9 million.

A Duelbits co-founder eventually reported losses of around $7 million. A compromised private key is believed to have caused the incident. In 2024, the platform lost $4.6 million in an attack that CertiK also linked to a possible private key leak.

Meter attack sends two tokens plunging

The third affected project was the EVM blockchain Meter.io. Unlike the Payy Network attack, the hacker did not drain existing bridge reserves but exploited a block verification flaw to mint unbacked tokens.

According to Blockaid, the attacker created around $2.3 million worth of assets and then sold them through decentralized exchange PancakeSwap. The Meter team said it had preserved the network state, although it has not yet determined how the network will be restored.

The sale of the unbacked assets triggered sharp declines in Meter-related tokens. MTR lost nearly 80% of its value, while MTRG fell around 75%. The project previously suffered a bridge exploit in 2022 that resulted in losses of approximately $4.4 million.

The series of attacks came amid a much larger incident involving Bitget. The exchange reported unauthorized asset transfers worth around $351.6 million from a limited number of wallets and temporarily suspended withdrawals while conducting security checks.

Bitget said trading and deposits continued to operate normally and user balances were displayed correctly. The company is investigating the incident and analyzing the circumstances of the movement of funds.

Earlier, we reported that KelpDAO filed a lawsuit against LayerZero and its co-founder Brian Pellegrino over a $292 million hack. KelpDAO claims undisclosed risks and shortcomings in LayerZero's technology were responsible for the attack.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.