Chainflip's hacking incident on TRON: How to check if your USDT redemption is still stuck

Chainflip Cross-Chain Swap Protocol Failure Resolution: September 12 Event Review and User Response Guide

If you initiated a swap operation via Chainflip over the weekend and haven't received any assets so far, the problem is almost certainly not in your own wallet. The network has been at a standstill since Saturday.

On September 12, 2026, an attacker stole 736,442.17 USDT via the protocol's Tron channel, and Chainflip suspended trading in response. What is important to you right now is that your balance has not disappeared, it is just temporarily inaccessible. This article explains which features have been explicitly turned off, which are still running, and in what order you should check your positions.

What happened to Chainflip on September 12, 2026?

Chainflip is a swap protocol that transfers value between different blockchains. According to a matching report from two industry publications, in the early morning of September 12, 2026, an attacker stole 736,442.17 USDT from the settlement path of the agreement on Tron. At that time, the incident only surfaced due to the failure of subsequent USDT payments. Subsequently, the team stopped network operations.

The attack lasted approximately 90 minutes. According to crypto.news, there were eight attempts, six of which successfully won payouts. The amount is increasing: Analysis shows that the amount for each subsequent attempt is approximately double the amount for the previous one. Chainflip said it had fixed the vulnerability, flagged the stolen funds, and announced that affected users would receive full compensation after the network was restarted. As of press time, the earliest restart time is scheduled for Monday.

List of key event data

• The stolen amount is 736,442.17 USDT.
• Only settlement on Tron is affected.
• According to two sources, another outstanding swap worth US$115,654.41 is still hung in the agreed position and is considered eligible for reimbursement.
• For other networks, neither report recorded any losses.

Analysis of the principle of cross-chain swaps: The difference between Chainflip and traditional bridging

Cross-chain swaps refer to the transaction in which you deposit assets on one blockchain and receive assets in different currencies on another blockchain. Traditional bridging solutions typically lock in your Bitcoin and issue a placeholder for you on the target chain, the so-called "Wrapped Token". Chainflip does not need such a placeholder: the validator network jointly holds the funds and pays for the real assets on the target chain.

For users, the normal operating process is as follows: the system provides you with a deposit address, you send assets to that address, and a few minutes later, the exchanged assets will appear in the wallet of your target chain. This process requires no account registration, no login, and no user self-hosting during the process. It is this design that causes the agreement to stall, which will directly affect users: there is no customer interface for you to directly withdraw funds.

Memo trick on Tron: Why the same signature transfer is read twice

On most supported networks, Chainflip reads swap instructions from contract calls. But on Tron, according to a technical report at crypto.news, it works differently: The agreement evaluates the memo field (memo) in the transfer, a free-text field that can be attached to the transaction.

The attacker reportedly attached another memo to a transaction signed by the verifier. The system treats this additional content as an independent second exchange instruction. When the second order appeared to fail, the agreement paid a refund even though the original deposit had been serviced. The core of the event is that the signature remains valid, but the readable content next to it can still be changed.

A key point raised in both reports is crucial to understanding background: no private keys were stolen and no custodian was compromised. Payments come from the normal process of the agreement and are triggered by instructions that the agreement considers to be true.

This is like putting a second label on goods that have already been processed after the fact: an additional memo has a similar effect on a transaction that has already been signed.

Our measurement results on September 13, 2026: Which Chainflip functions have been turned off

cryptoticker.io collected this analysis data on September 13, 2026. Chainflip reports network status in its public programming interface that anyone can query. We made seven calls between 15:53 and 15:56 UTC time, recorded the response code each time, and additionally checked the provider's quote services on four swap routes.

The results are unambiguous. The Swap Business Section reported that there were three switches set to "off": Swap Off, Deposit Off, and Withdrawal Off. The same goes for liquidity providers on all three routes. The provider's quoting service returned a code of 503, meaning "service unavailable", on all four routes tested: including Bitcoin to Ethereum, USDC on Ethereum to USDT on Tron, USDT on Tron to USDC on Ethereum in the reverse direction, and Solana to Bitcoin.

In the meantime, what functions are still running?

What is more interesting than closed projects are projects that are not closed. The network share return in the capital area is set to "on"(on). Liquidity providers can continue to adjust their offers. Verifier rotation and bids registration and deregistration are running. Registration for new brokers is also open.

The blockchain itself is also operating undisturbed. The network node reported that there were 36 peer nodes and no synchronization was in progress. Two head block calls separated by 137 seconds returned heights of 14,801,511 and 14,801,534 respectively, which means that 23 new blocks were generated, with an average of about six seconds per block. The network is producing blocks; it just doesn't make transactions.

You can also read from the interface: Chainflip currently supports 18 assets on seven networks, including Bitcoin, Ethereum, Solana, Arbitrum, Polkadot, Assehub, and Tron. For Tron, the minimum deposit amount is 30 TRX or 10 USDT.

This measurement has two limitations. First, it is impossible to determine externally whether individual stuck swaps will automatically complete after a restart. Secondly, the number of users affected is not measurable, and Chainflip has not released relevant data. The figure of 115,654.41 USDT for outstanding swaps comes from media reports rather than our inquiries.

Network is running, transactions are suspended: The impact of safe mode on your balance

The state we measure is not an outage, but an expected operating mode. The protocol can close various functional areas without stopping the blockchain. This is exactly what happens here, and the choice of switches reflects the current situation.

Withdraws are also closed, which is the most unpleasant part for you. This means that even if the swap has been completed and the proceeds remain in the agreement, they will not currently move to you. At the same time, this is also a measure taken to prevent funds from being stolen again through the same channel before the cause is completely solved. Liquidity providers can still adjust offers, indicating they are preparing to restart trading rather than clearing agreements.

There is a simple rule for your own course of action: In this case, waiting is the right choice and sending more assets is the wrong choice. Anyone who sends funds to an old deposit address now only adds to the list of cases that need to be processed after the restart.

How to check for stuck Chainflip swaps: Follow the following four-step sequence

Follow the following steps in sequence. The order is not arbitrary: the first two steps cost zero and determine whether you are affected.

Step 1: Find the swap record in the protocol's block browser.

Each swap has a unique identifier, which will be displayed to you when booting. Enter it into the provider's blockchain browser. It will show the stuck status of the case: whether it is at the deposit stage, during the swap process, or before payment. If your case cannot be found at all, it means that it has never been accepted and the funds are still in the source chain.

Step 2: Check outbound transactions on the source chain

Find the transfer you used to deposit in the source chain browser. Two situations need to be distinguished. If it has been confirmed and reaches the deposit address, your funds are in the agreement and you just need to wait for the restart. If it is not confirmed or never sent, nothing has happened and you can swap it elsewhere.

Step 3: Check the target address in the wallet

View the wallet you provide as a target and make sure it is on the right chain. A common misconception is that the benefits have already arrived, but the wallet does not show the target network at all. If your wallet only carries the Ethereum version of USDT, the USDT on Tron will not be displayed.

Step 4: Follow the provider's announcement, not the comment area

The restart date and whether stuck cases will automatically complete are all up to the provider. Adhere to using its official channels. Within a week of such an incident, false offers of help asking for your mnemonic words appear in large numbers. A reputable provider will never ask for this information. If you want to save the key on your device anyway, refer to our Hardware Wallet Comparison article.

Don't use deposit addresses again: Why additional deposits will be idle

Deposit addresses for such agreements are tied to individual swap orders and are only valid for a limited time. Our measurements show that the deposit path has also been closed. Therefore, transfers made to the address of old orders will not be processed at this time.

On blockchain, the amount will still be deducted from your wallet. It is located at an address you do not control, and whether and when it is assigned depends on the provider. That's why there's a separate title here: it's the only mistake that could turn the waiting period into a real loss.

Six of the seven functional groups are still running, and swap services are suspended: This is what the security model looks like in the September 13, 2026 query.

#@0_46#@

Promise to compensate: What is covered and what is not covered by the announcement

According to matching reports from two industry publications, Chainflip announced that affected users will receive full compensation once operations resume. The wording is clear, but the path is unclear: at the time of reporting, the source of the reimbursement was unclear. Reserves, ongoing negotiated income and insurance solutions are listed as options under review.

For you, this means a commitment without dates and procedures. So save now what may be used as evidence in the future: your swap identifier, the transaction number of the deposit, the time, the amount, and screenshots of the interface (if any). Those who have to collect these records after a reboot will be in a worse situation than those who file them that day.

Part of the background also deals with what the commitment does not include. This is not legal deposit insurance. Decentralized swap agreements do not enjoy the same protection as bank accounts, and promises in announcements are different from enforceable claims.

Aggregators and wallets: How to tell if your swap is running via Chainflip

Many users have never encountered such a protocol under their own name. Wallet and swap aggregator integrate them in the background and route your orders to the path that currently provides the best exchange rate. Therefore, it is entirely possible that you chose the brand without knowing it and were affected.

The way to prove lies in historical records. Open your wallet or the order history of the service you use to view relevant cases in detail. It usually displays the route used, or at least the deposit address, which you can track further in the source chain's blockchain browser. If the entry is unclear, customer service for the service you use can help because you are a direct customer there.

Memo field on Tron: Why this design comes with risks

Memo is a free-text field that many chains can attach to transfers. Exchanges have been using it for years to allocate incoming payments (incoming payments) to the right customer accounts. For protocols, this is convenient because it does not require its own contract and can therefore quickly connect to the new network.

The price for this convenience is that free text has no fixed format. The contract function enforces the structure, which can be secured along with the signature; the attached text is just text at first. The attacks described here exploit this gap between signed content and read content.

The practical conclusions you can draw from this are independent of the provider: if a service requires you to send a memo or tag with it, that field is part of the transfer, not a decoration. Deposits that lack the required memos often fall into no man's land and must be allocated manually. Chainflip has been expanding its Tron channel recently; the latest post on its official blog was published on September 10, 2026, promoting USDT on Tron as collateral for loans. At the time of our September 13 check, there were no posts on the blog about the incident; according to two industry publications, the quoted statement came from short message service X.

Liquid, Sandbox and Chainflip: Why transition zones between networks are vulnerable

This case is one of a series of incidents. On September 6, 2026, approximately 4,000 bitcoins left Liquid Network's alliance wallet, and sidechains subsequently lost most of their endorsements; we recalculated L-BTC endorsements at that time. In August, it was the bridge agreement for the Sandbox project. Now it's this swap agreement with no placeholder tokens.

What these three cases have in common is not the design, because the designs differ widely in all three cases. The common denominator is location: as long as one chain must believe what another chain says about what happens on it, translation (here, information transformation/mapping) occurs. The translation may be misread, and the wrong reader will be taken of funds but never held the key.

This doesn't mean panic, but it brings with it a sobering daily rule: The transition zone between the two chains is a place to stop briefly. The value you want to hold over the long term should be attributed to its original chain, and you should control how the key is managed. Swap agreements are channels, not warehouses.

Check your Chainflip swap: Summarize the three steps of the key points

, in this order, and each step should not exceed a few minutes.

Determine today whether you are affected.

Find your swaps in the protocol's block browser and check deposits on the source chain. Don't send any funds to the old deposit address until the restart. If you need swaps during this period, please use a trading platform with customer accounts and customer services; the terms of large providers can be viewed in our crypto exchange comparison article.

Archive your records before you need them.

Case identifier, transaction number, time, amount, screenshot. People who regularly move large amounts of money are more advantageous to be served by regulated providers with complaint channels than by agreements with no opposing parties; for which institutions hold European licenses, please see our overview of regulated cryptocurrency exchanges.

Once your balance is available again, organize your hosting method.

Don't keep anything permanently in the transition agreement and separate day-to-day use funds from long-term positions. For which wallet is suitable for which purpose, please refer to our software wallet comparison article.

The second independent incident report cited in this article comes from The Crypto Times.

(As of September 13, 2026. This article does not constitute investment advice. Price and fee structures are subject to change; please check terms with your provider before purchasing.)