Three crypto projects suffered more than $11 million in combined damage on Sep. 24, with Payy Network, Duelbits and Meter Network hit through separate attack methods.
Key Points:
- Payy Network lost about $1.8M after its Ethereum bridge was drained, while Duelbits reported losses of roughly $7M.
- Meter attackers minted about $2.3M in unbacked assets and sold part of them through PancakeSwap.
- The incidents exposed risks across bridges, hot wallets and token verification systems.
Payy, Duelbits Attacks
Payy Network, an on-chain payroll and treasury platform, halted its network after the Ethereum (ETH) bridge attack. Onchain researcher Specter traced suspicious bridge transfers and said the attacker used Railgun for funding before swapping about $1.8M in USD Coin (USDC) into Ethereum. Payy said the drained assets were non-custodial deposits belonging to Payy Network and Payy Wallet users.
Duelbits was hit next, with PeckShield first estimating $4.3M in losses before Specter identified additional affected addresses on Bitcoin (BTC) and Solana (SOL). A Duelbits co-founder later put the total near $7M and said, “User funds are safe.”
Meter’s incident used a different mechanism. Blockaid said an attacker exploited Meter Passport to mint about $2.3M in unbacked assets before selling some through PancakeSwap, while MTR (MTR) fell nearly 80% and MTRG (MTRG) dropped about 75%.
Also Read: Ethereum Breakout Hinges On $2.8K After 200-Day Average Reclaim
Blockaid Security Context
Security researchers pointed to different failure points across the three incidents, rather than one common exploit. Payy later said its initial root-cause review found the breach “was NOT a compromised key, social engineering or exploit of our off-chain infrastructure,” while reports around Duelbits pointed to a likely private-key compromise. Blockaid’s findings on Meter instead centered on unauthorized minting through the bridge.
The cluster of attacks also arrived as Bitget investigated unauthorized asset transfers initially estimated at about $351.6M and temporarily suspended withdrawals for security checks. Trading and deposits continued, and the exchange said displayed user balances remained correct. Separately, KelpDAO has sued LayerZero and co-founder Brian Pellegrino over a $292M hack, alleging undisclosed risks and technology shortcomings caused the loss.
The Sep. 24 incidents also revived earlier security concerns at two of the affected projects. Duelbits lost about $4.6M in a 2024 attack linked by CertiK to a possible private-key leak, while Meter suffered a roughly $4.4M bridge exploit in 2022.
Read Next: Michael Saylor Wants Banks To Turn Bitcoin Into Everyday Collateral
