Three DeFi Exploits Drain More Than $11 Million in One Day
Three DeFi attacks cost $11 million in one day
Three crypto projects lost more than $11 million combined on Thursday. Two of the attacks hit bridges, the tools that move assets between blockchains, and one involved a suspected private key compromise.
Payy Network lost $1.8 million, crypto casino Duelbits lost about $7 million, and blockchain Meter.io lost $2.3 million, according to the projects, on-chain investigators and security firms that tracked the incidents.
Crypto and DeFi projects have been hit repeatedly in recent weeks, and few days have been free of incidents.
The losses at a glance
- Payy Network: $1.8 million drained from its bridge to Ethereum.
- Duelbits: about $7 million, according to its co-founder.
- Meter.io: $2.3 million in tokens created without backing and sold.
- Combined total: more than $11 million.
Payy's Ethereum bridge emptied and operations paused
Payy Network is a rollup, a type of network that processes transactions and settles them on a larger blockchain, and it offers on-chain payroll and treasury services. Its bridge to Ethereum was the first to be hit.
Specter, a pseudonymous on-chain investigator, first flagged suspicious withdrawals in a message to its Telegram group. The attacker, who was funded through the privacy protocol Railgun, swapped $1.8 million of USDC for ETH. USDC is a stablecoin, a token designed to hold a steady value.
Payy later confirmed the exploit. The company said its bridge contract on Ethereum was drained of its full balance at 4:21 UTC, and that all network transactions, including deposits and withdrawals, were paused while it investigates. Payy described the lost funds as users' non-custodial deposits to Payy Network and Payy Wallet. It has not yet said what caused the loss.
Duelbits goes offline as its loss estimate rises
Estimates of the Duelbits loss changed several times during the day. Blockchain security auditor PeckShield first put the figure at $4.3 million. Specter then raised it to $4.9 million and later to $5.9 million after identifying affected addresses on Bitcoin and Solana.
Duelbits co-founder Joe gave a final figure of roughly $7 million. He said the platform would stay offline until the team has clarity, that user funds are safe, and that the next steps are to finish the investigation, re-top hot wallets (online wallets used for daily operations) and relaunch as what he called Duelbits 2.0.
The suspected cause was a private key compromise, according to the scam-tracking account ScamSniffer. A private key is the secret code that controls a crypto wallet. Duelbits was previously hacked for $4.6 million in 2024, when auditor CertiK also suspected a private key compromise.
Meter.io attacker minted tokens out of thin air
Meter.io, a blockchain that runs Ethereum-style smart contracts, said an attacker used a block validation flaw to mint unbacked MTR and MTRG tokens, sell them on decentralized exchanges and bridge the funds out. The team said the incident happened on Sep 23 at 21:14 UTC, and that the mainnet and its bridge are paused.
Blockaid reported that tokens worth $2.3 million were created and dumped on the PancakeSwap exchange. Figures cited in the report show the price of MTR down almost 80% and MTRG down almost 75%.
Meter said it has preserved the chain state and that the recovery method is still to be decided. The project was hacked before, for $4.4 million in 2022, in what was also a bridge hack.
What is confirmed and what is not
- Confirmed: Payy, Meter.io and Duelbits all reported losses, and Payy and Meter said operations were paused.
- Confirmed: Payy's bridge on Ethereum was drained of its full balance, and the company has not disclosed the cause.
- Reported: the Duelbits loss is about $7 million, per its co-founder, a higher figure than earlier estimates from PeckShield and Specter.
- Reported: Meter said a block validation flaw let unbacked tokens be created, and Blockaid put the value at $2.3 million.
- Not confirmed: the exact cause of the Duelbits loss. A private key compromise was suspected, not confirmed.
Why this matters for bridge users
Two of the three incidents involved bridges, which move assets between blockchains. Bridges have been targeted repeatedly: Meter's earlier $4.4 million loss in 2022 was also a bridge hack. Duelbits had also been hacked before. The pace of attacks on crypto and DeFi projects has stayed high in recent weeks, with few days free of incidents.
What each project says comes next
Payy says all network transactions are paused while it investigates, and it has not given a date for resuming. Meter says the chain state is preserved, but it has not decided how recovery will work. Duelbits says it will finish its investigation, refill hot wallets and relaunch as Duelbits 2.0, without giving a timeline.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.