Payy's Ethereum bridge contract drained of $1.83m in USDC

What happened

At 04:21 UTC on 24 September 2026, a verifyRollup batch on Payy's Ethereum rollup contract paid out 1,828,589.38 USDC, the contract's full balance, to a single address. Payy, a privacy stablecoin payments network, confirmed the drain at 14:04 UTC and paused all deposits, withdrawals, transfers and card transactions.

The batch came from the same account that has posted Payy's rollup batches since February 2026, so the withdrawal rode inside an ordinary batch; the receiving address had made two deposits into Payy on 22 and 23 September. Within two minutes the USDC moved to a second address, where it became 683.38 ETH, about $1.83m at Chainlink's ETH/USD price of $2,683.07 at 17:00 UTC, and was split mainly across three addresses in payments of 282.38, 200 and 200 ETH. Payy says the investigation is ongoing under its incident response guidelines.