Chainflip loses $736,000 in USDT after TRON exploit, halts network

On September 12, 2026, decentralized swap protocol Chainflip suffered its first critical vault exploit, losing 736,442.17 USDT. An attacker manipulated TRON transaction memos to trick validators into executing duplicate payouts. Chainflip suspended all cross-chain routes and scheduled a network restart for September 14 at the earliest. The protocol has committed to making affected users whole, while a pending swap of 115,654.41 USDT remains safely held in its vault.

TRON memo parsing vulnerability

• ▪Unlike other blockchains integrated with Chainflip that pass swap instructions through dedicated contract functions, Chainflip's TRON settlement layer reads swap parameters from transaction memos
• ▪Chainflip's systems interpreted the added TRON transaction memo as a separate swap instruction, classified the duplicate swap as failed, and issued a refund, effectively paying out the same deposit twice
• ▪Chainflip plans to increase its internal use of advanced artificial intelligence models for security testing following the TRON USDT exploit
• ▪An attacker exploited Chainflip's TRON USDT integration on September 12, 2026, by attaching a new memo to a transaction that Chainflip validators had already signed

Network suspension response

• ▪Payment integrator MakePay publicly expressed its full support for Chainflip's response to the exploit on the social media platform X
• ▪Chainflip announced that its network would remain paused until Monday, September 14, 2026, at the earliest, while developers finalize a fix and a coordinated restart plan
• ▪Chainflip paused its entire network and suspended all swap routes following the detection of the TRON USDT exploit on September 12, 2026

736,000 USDT theft

• ▪Chainflip described the 736,442.17 USDT exploit as its first significant critical security event involving a realized loss of money from its protocol vaults
• ▪An attacker drained 736,442.17 USDT from Chainflip's TRON settlement path through six unauthorized payouts on September 12, 2026
• ▪Chainflip detected the exploit after subsequent USDT payout attempts on the TRON leg began to fail and triggered internal alerts
• ▪The attacker repeated the duplicate-swap exploit eight times within approximately 90 minutes, with each later attempt doubling in size, though only six attempts produced unauthorized payouts

User reimbursement plan

• ▪A single pending user swap worth 115,654.41 USDT remains unpaid in Chainflip's vault and is expected to be processed after the network safely restarts
• ▪Chainflip notified relevant parties about the stolen funds to track their movement, but did not confirm if any USDT had been frozen by Tether as of September 13, 2026
• ▪Chainflip committed to making impacted users whole, though the protocol had not finalized or published its specific reimbursement method as of September 13, 2026

Prior August security incident

• ▪On August 24, 2026, Chainflip contained an attempted exploit targeting cross-chain messaging and refund logic on Ethereum, which resulted in no lost user funds
• ▪During the August 24, 2026 incident, Chainflip temporarily paused deposits and quoting on Ethereum, Arbitrum, and TRON before restoring services via a network upgrade

Debatable claims

• ▪Chainflip was justified in halting its entire network to contain the TRON exploit
• ▪Tether should freeze the USDT stolen in the Chainflip exploit