Chainflip encryption hack: How did attackers steal 736K USDT in 90 minutes?

Chainflip cryptographic assets hacked: 736,000 USDT stolen from TRON integration

The latest Chainflip cryptographic asset hacking news focuses on targeted attacks on the protocol's TRON USDT integration, the first such incident has occurred on the platform. Chainflip has confirmed that attackers found a way to manipulate TRON transaction memoranda (memos), deceiving the system into releasing the same deposit multiple times. The exploit caused the network to be temporarily suspended, and engineers are improving the repair plan and preparing for a safe restart.

Highlights

• Cross-chain protocol Chainflip confirmed that its TRON USDT integration was utilized on Saturday.
• The attacker abused a flaw in the handling of TRON transaction memos, triggering a duplicate payment of a deposit.
• The exploit was run eight times in approximately 90 minutes, resulting in six unauthorized payments worth USDT.
• Another user redemption transaction worth US$115,654.41 was not paid, but the funds were still safely locked in the vault.
• Chainflip said all other funds are safe, fixes are in place, and the network could be back up and running as soon as Monday.

Principle of vulnerability exploitation

Chainflip relies on a memo field attached to TRON transactions to read redemption instructions, an approach that is different from most other dedicated contract functions that support use on the chain. According to the parties to the agreement, the attacker discovered a way to attach a new memo to transactions signed by the Chainflip verifier. The system then treats reading the memo as a separate failed redemption and automatically issues a refund, effectively allowing the same underlying deposit to be paid more than once. The attacker first used small transactions to confirm that the technology was feasible, and then roughly doubled the amount in each subsequent attempt.

Loss and vault status

Chainflip hack impact details

Affected blockchain TRON USDT integration 6 unauthorized payments Total USDT loss 736, 442.17 USDT attack attempts 8 attack duration approximately 90 minutes pending user redemption 115,654.41 USD T pending funds status securely held in the vault other agreement funds are not affected and secure user compensation is promised by Chainflip. Current analysis shows that the total loss is 736,442.17 USDT, distributed among six unauthorized payments. Another redemption worth US$115,654.41 could not be completed and is currently sitting in the vault rather than missing.

Attack timeline

The exploit occurred early Saturday morning and lasted about an hour and a half from start to finish. The attackers tested the vulnerability with small transactions before scaling up, roughly doubling the size of each transaction in eight attempts. The Chainflip team eventually noticed that subsequent USDT payments failed, which prompted them to conduct an internal investigation. Once the mode is confirmed, the network is suspended and a security response is launched, ultimately committed to locking in a comprehensive restart plan.

Explanation on the pending exchange of 115,000 USDT

Not all abnormal transactions in this incident represent losses. Once an exploit was detected and the system froze further payments, a user's 115,654.41 USDT redemption request could not be processed. Chainflip clarified that the amount was separated from the stolen funds and is still safely stored in the vault. The parties expect that this pending exchange will be resolved once operations resume.

Source: Wu Blockchain

#@0_49#@

Security fixes and network suspension

Chainflip has suspended its network to prevent any further exploits, while engineers are investigating the root cause. The company said fixes for the underlying vulnerabilities have been finalized, although the exact restart process still requires additional work to avoid complications. According to reports, the team has flagged the used funds to relevant industry stakeholders, hoping to recover some of the stolen assets as they move through the crypto news ecosystem.

Can users get back their funds?

Chainflip said affected users will receive full compensation, although the specific compensation mechanism is still being determined internally. The company characterized the incident as fully recoverable, even as it continues to evaluate the best way to reimburse affected users and recover stolen assets. A full technical report is expected to be released once the restart plan is locked.

Broader security implications

Chainflip described this exploit as its first major security incident resulting in the loss of treasury funds, highlighting how transaction processing logic in a single chain, such as TRON's memorandum system, can become a weakness in mature cross-chain infrastructure. The company also pointed to the industry's increasingly complex trend of attack tools and said it plans to strengthen the use of its own security tools to proactively discover problems in the future.

Chainflip Today's Price: September 14, 2026

The Chainflip token price (FLIP) was $0.3279, up 1.4% in 24 hours. The FLIP token has a market value of US$28.92 million and a 24-hour transaction volume of US$57,935.8.

Source: Coingecko Data

Conclusion

This cryptographic asset hacking news highlights how narrow chain-specific flaws in memo processing can be exploited into expensive vulnerabilities. With 736,442.17 USDT confirmed losses and another 115,654.41 USDT safely held pending restart, the immediate priorities are clear: improve the repair plan, safely resume operations, and compensate affected users. A full accident report is expected to be released in the next few days.

Disclaimer : This article is for reference only and does not constitute financial, investment or legal advice. Cryptocurrency markets and protocols carry significant risks, including the risk of being hacked, exploited, and total loss of funds. Before making any financial decisions, be sure to do your own research and consult a qualified professional.