Chainflip pays out twice on replayed Tron memos

What happened

On 12 September 2026, an attacker attached fresh memos to Tron transactions Chainflip validators had already signed, so the protocol read each as a separate failed swap and refunded deposits it had already paid. Six unauthorised payouts over about ninety minutes took 736,442 USDT before failing payouts exposed the pattern. Chainflip says impacted users will be made whole.

Chainflip reads swap instructions from memos on Tron transactions, where most supported chains use dedicated contract functions. The attacker ran the replay eight times, starting small and roughly doubling each round, with six payouts landing. A pending 115,654.41 USDT user swap stayed in the vault through the halt. The exploited funds are flagged with tracing parties, and the protocol calls this the first critical loss of funds from its vaults.