protos.com
Crypto and DeFi projects continue to be hacked at a dizzying pace, and few days in recent weeks have been incident-free.
That said, Thursday was a particularly busy day, with three projects hit for a total of more than $11 million worth of crypto.
By the end of play, Payy Network had lost $1.8 million, Duelbits $7 million, and Meter $2.3 million.
Payy Network
The bridge connecting Payy Network, a rollup which offers on-chain payroll/treasury services, and Ethereum was first to be hit.
Pseudonymous on-chain investigator Specter first flagged suspicious withdrawals in a message to its Telegram group. Funded via privacy protocol Railgun, the attacker swapped $1.8 million of USDC for ETH.
The firm later confirmed the exploit, which drained the entire balance of its bridge, and paused all operations. It then clarified that the funds were “users’ non-custodial deposits to Payy Network/Payy Wallet,” but is yet to disclose the cause of the loss.
Today at 4:21 UTC Payy’s bridge contract on Ethereum was exploited and drained of its full balance.
— Payy (@payy_link) September 24, 2026
Investigation is ongoing and we are following incident response guidelines.
While we investigate, all Payy Network transactions are paused including deposits, withdrawals,…
Duelbits
Crypto casino and sports betting platform Duelbits was next up in a suspected private key compromise.
The estimated losses stacked up from blockchain security auditor PeckShield’s first tally of $4.3 million. Specter upped the ante to $4.9 million and then $5.9 million after identifying affected addresses on Bitcoin and Solana.
Duelbits’ own co-founder put the final number at approximately $7 million.
Confirming a ~$7M hack. Still investigating exactly what happened and how.
— Joe (@DuelbitsJoe) September 24, 2026
Until we have clarity, Duelbits stays offline. User funds are safe.
Next steps: finish the investigation, re-top hot wallets, and bring Duelbits back online, launch Duelbits 2.0.
I'll keep posting… https://t.co/V4Zl4St31I
The project was previously hacked for $4.6 million in 2024. At the time, auditor CertiK also suspected the loss to be due to a private key compromise.
Meter.io
EVM blockchain Meter.io also fell victim to a bridge attack, but this time, unbacked tokens were minted instead of existing deposits being drained.
Addressing the incident via X, the team pointed to a “block validation flaw” and informed users that “we’ve preserved the chain state. The recovery method is still to be decided.”
1/
— ⚡️Meter.io⚡️ (@Meter_IO) September 24, 2026
🚨 Security incident on Meter mainnet
On Sep 23 at 21:14 UTC, an attacker exploited a block validation flaw to mint unbacked MTR and MTRG, dump them on DEXs, and bridge funds out.
Mainnet and the bridge are paused. Please stop all activity on Meter. 🧵
Tokens worth a reported $2.3 million were minted out of thin air before being dumped on the PancakeSwap decentralized exchange.
The sales crashed the price of both MTR and MTRG tokens, which are down almost 80% and 75%, respectively.
Meter has also been hacked before, for $4.4 million back in 2022, in what was also a bridge hack.