What happened in the September 24, 2026 exploit of Payy Network, the privacy-focused stablecoin payments platform, including the single-transaction USDC drain at Ethereum block 26044909 at 04:21 UTC, the abuse of its verifyRollup function for confirming off-chain activity on Ethe

Payy Network reportedly suffered an Ethereum bridge/rollup exploit on September 24, 2026, losing approximately $1.83 million in USDC and suspending its payments services.67 The available evidence supports the broad incident, but does not establish every technical detail in the question or reconcile the differing loss estimates.

What happened

• Drain and timing: An initial report described about $1.83 million in USDC leaving Payy’s Ethereum contract in a single transaction; a separate social-media report placed the exploit at 04:21 UTC.450 Insufficient evidence is available here to independently confirm Ethereum block 26044909.
• Mechanism: Reporting identified a malicious verifyRollup transaction, while a security-related social post said the batch was submitted using Payy’s own prover key and signed with its validator key.1150 These observations do not, by themselves, establish whether the underlying cause was a circuit flaw, compromised keys, or another validation failure.
• Loss estimates: Reports differ: approximately $1.83 million is widely reported, while TokenPost gives 1,832,149.46 USDC.47 Other retrieved reporting describes roughly $1.92 million and conversion into approximately 683 ETH.13 The available evidence does not reconcile those figures with the question’s 1,828,589 USDC / roughly 95% estimate; they should not be treated as interchangeable audited totals.

Funds and operational response

• Attacker funding: Reporting attributed to Specter Investigation says the attacker obtained initial funding through Railgun.15 That is distinct from proving that the stolen proceeds subsequently passed through Railgun.
• Movement of proceeds: Retrieved reporting says the stolen funds were converted into approximately 683 ETH, with most subsequently sent to three wallets.13 Insufficient evidence establishes that Railgun itself was exploited or that its use has already prevented recovery.
• Service suspension: Payy suspended deposits, withdrawals, transfers, and card payments.7 Reports of Payy’s announcement also describe cooperation with law enforcement and incident-response teams.10
• Customer outlook: No restart date or customer-loss breakdown was disclosed in the September 25 report.7 I cannot verify a reimbursement commitment or the proposed preventive network upgrade from the available excerpts.

Earlier vulnerability and unresolved questions

• June precedent: The retrieved L2Beat entry records a critical aggregation-circuit vulnerability disclosed on June 10, 2026, which allowed forged burn messages and was patched.8 However, the available excerpt does not verify the version 1.3.0 detail or the assertion that no losses occurred before that patch.
• Connection to September: Insufficient evidence establishes that September’s exploit reused the June flaw. A previous vulnerability is relevant security history, not proof of the later attack’s root cause.
• Recovery: I don’t know whether Railgun use will materially complicate recovery in this case. The unresolved issues are the attacker’s identity, the subsequent destination and recoverability of the assets, the definitive technical cause, and whether customers will be reimbursed.