Chainflip suspends network, TRON integration encounters 736,442 USDT vulnerability

Chainflip suspends its network due to TRON integration vulnerability and loses approximately US$736,000 USDT

The cross-chain protocol Chainflip disclosed a security incident in which the USDT integration on its TRON (wavefield) network encountered a targeted attack, resulting in the theft of 736,442.17 USDTs. The agreement has quickly suspended network operations to control the situation, and is currently working to formulate a comprehensive repair plan that will resume normal services after the problem is resolved.

Attack details using swap instructions vulnerability

Unauthorized transfer of funds occurs when an attacker exploits a specific weakness in the Chainflip and TRON interaction mechanism. TRON is a blockchain platform known for its high-throughput decentralized transactions. Chainflip, a cross-chain protocol that allows seamless asset swaps between multiple blockchains, confirmed that a total of six illegal transfers were made before the network was suspended.

All other funds remain safe and unaffected, and Chainflip promises to ensure that affected users receive compensation. The network will remain suspended until the team completes technical fixes and determines a restart strategy.

Developers explained that on the TRON network, transaction notes (memos) are used to pass exchange instructions. However, unlike other support networks that use dedicated contract functions, this mechanism exposes Chainflip's TRON integration to risk. An attacker attaches his own remarks to a signed transaction, causing the protocol to mistake it for a separate exchange instruction.

This manipulation resulted in Chainflip processing two payouts from one deposit. Over a period of approximately 90 minutes, the attacker used this method to perform eight operations: initially testing the effectiveness of the method using a small amount of money, and then gradually increasing the amount with repeated attempts.

It is worth noting that a normal user exchange worth US$115,654.41 was not affected because the transaction was still pending when the network was suspended. The funds are currently stored securely in Chainflip's vaults and can be released after a network restart.

Background knowledge and data summary

Introduction to Chainflip: As a cross-chain protocol, Chainflip allows users to directly swap assets without having to hold intermediate tokens or rely on a centralized exchange. Its integration with multiple blockchain networks aims to simplify the decentralized finance (DeFi) experience by providing low-friction cross-chain transfers and exchanges.

Responses, Commitments and Next Steps

Chainflip has notified law enforcement that it is trying to track the flow of stolen funds through various encrypted networks. The company said its treasury and other positions were not damaged, which was the first time that the agreement suffered significant losses on user deposits due to a loophole.

A technical patch for the vulnerability has been developed, but the team needs more time to ensure that all services are safely restored. After the update is implemented, the company will release a detailed report explaining the details of the vulnerability and the planned recovery method.

Chainflip reiterated its intention to compensate victims in full, but clarified that further analysis was required before specific remedies could be identified. A number of ways to recover lost funds are currently being considered.

The incident also prompted Chainflip to strengthen its internal security procedures, especially when integrating networks with different trading mechanisms, such as TRON. The team noted that increasingly sophisticated threats are a growing challenge for all DeFi projects and acknowledged the impact of advanced AI tools in attack strategies.

This incident highlights the importance of rigorous integration testing in different blockchain networks and the need to establish adaptive defenses in the context of evolving technologies in the DeFi field.

Chainflip's business will continue to be suspended, with the longest suspension expected to be until September 14, as the team works to achieve a safe restart. Once operations resume, the agreement will address user compensation issues and implement plan updates aimed at strengthening future security measures.