Chainflip to reset Tron liquidity provider balances to zero following $736,000 exploit

Following a September 12, 2026 exploit that drained 736,442.17 USDT from its TRON vault, cross-chain protocol Chainflip is resetting affected liquidity providers' active balances to zero. The attack exploited a malformed memo vulnerability to trigger double-payouts. While Chainflip has resumed services for other networks, TRON remains paused. The protocol has recorded pre-migration balances on-chain and pledged to make users whole, but has not yet disclosed a repayment timeline or funding source.

Chainflip TRON USDT exploit

• ▪An attacker exploited the cross-chain swap protocol Chainflip on September 12, 2026, draining 736,442.17 USDT from its TRON vault.
• ▪The September 12, 2026 exploit that drained 736,442.17 USDT from Chainflip's TRON vault is the first significant critical security event resulting in the loss of funds from Chainflip vaults

Malformed memo vulnerability

• ▪The attacker behind the September 12, 2026 Chainflip TRON vault exploit drained Chainflip's TRON vault by submitting a transaction signed by Chainflip validators with a malformed memo, causing six withdrawals to pay twice
• ▪Chainflip patched the malformed-memo vulnerability that let an attacker trigger double-payouts from its TRON vault by restricting accepted memos to plain TRX transfers or direct TRC-20 token transfers, excluding contract-wrapped transfers

Liquidity provider balance reset

• ▪Chainflip will set to zero the active TRON USDT balances of liquidity providers affected by the September 12, 2026 TRON vault exploit, and close open TRON/USDT orders, strategies, and lending positions
• ▪Chainflip will record each liquidity provider's pre-migration balance from before its restart following the September 12, 2026 TRON vault exploit in a separate on-chain record to track the amount owed for future recovery

Repayment timeline uncertainty

• ▪Chainflip pledged to make whole liquidity providers affected by the September 12, 2026 TRON vault exploit but has not disclosed a funding source, payout schedule, or confirmed recovery amount
• ▪A user swap of 115,654.41 USDT remains sitting in Chainflip's TRON vault, which Chainflip states is payable once the network is back online

Service restart excluding TRON

• ▪Chainflip resumed swaps and quoting across the rest of its network by September 16, 2026, while keeping TRON excluded from its restart plan following the September 12, 2026 TRON vault exploit
• ▪Chainflip stated that all other funds outside of its TRON vault were unaffected and secure following the September 12, 2026 exploit in which 736,442.17 USDT was drained from that vault

Debatable claims

• ▪DeFi protocols should restrict smart contract interactions to prevent exploits
• ▪Chainflip is justified in resetting affected liquidity provider balances to zero