Skip to content
Chainflip Network Paused After $736K Tron USDT Exploit

Chainflip Network Paused After $736K Tron USDT Exploit

First seen 13 Sep 2026, 15:56 UTC • •

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 14, 2026 at 15:19 UTC
  • •Chainflip lost 736,442.17 USDT due to a memo manipulation exploit on its Tron integration.
  • •The network is paused until at least September 14, 2026, while the team addresses the exploit.
  • •Affected users will be compensated, and a pending swap of 115,654.41 USDT is recoverable.

Chainflip, a decentralized cross-chain swap protocol, halted its network after an attacker exploited its Tron settlement path, draining 736,442.17 USDT on September 12, 2026. This incident marks the first significant security event resulting in a loss of funds from Chainflip's vaults. The attacker manipulated the protocol by attaching a memo to a signed transaction, causing the system to issue duplicate refunds. Affected users will be compensated, with a pending swap of 115,654.41 USDT recoverable upon network restart. Chainflip has paused operations to address the exploit and is expected to remain offline until at least September 14, 2026. The team is analyzing compensation options and has flagged the exploited funds for recovery efforts. This incident highlights the vulnerabilities in the protocol's handling of swap instructions on the Tron network.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 56d ago How this analysis works

Timeline

2026-09-12
Exploit executed on Chainflip's Tron integration
An attacker drained 736,442.17 USDT through memo manipulation, issuing duplicate refunds.
Cryptotimes
2026-09-13
Chainflip pauses network operations
The protocol halted its services to address the exploit and ensure user fund security.
Kucoin
2026-09-13
Chainflip commits to user compensation
The team announced plans to make affected users whole, with options for compensation under review.
Chainflip.io

More articles in this cluster (5)

Following this threat?

Track Arbitrum in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed