Payy suspends crypto card and stablecoin services after Ethereum bridge drain

Payy halted all stablecoin payments and card services after its Ethereum bridge was drained on September 24.

Incident timeline

The company said the exploit took place at 4:21 a.m. UTC, when a transaction moved 1,832,149.4681 USDC out of a Payy rollup contract on the Ethereum blockchain. It noted that the transaction occurred at block 26044909, timestamped 4:21:23 a.m. UTC. Payy announced that deposits, withdrawals, transfers and card purchases were paused while it investigates the breach.

The statement did not disclose a specific USDC amount or a transaction hash, so the reported outflow represents only the contract movement observed on-chain. Payy added that a fuller loss figure would depend on its internal accounting of the bridge beyond the visible transfer.

Impact on users

During the freeze, users cannot add or remove funds, send transfers, or complete purchases with the Payy card. The suspension affects both stablecoin movements and everyday spending through the app.

Payy did not disclose how many customers held balances or attempted transactions during the outage, so the number of affected users remains unknown. The company also said it has not yet determined whether the bridge loss impacts customer balances.

For users, the immediate consequence is the inability to use the service for payments or transfers, while the financial exposure continues to be assessed.

Company response

Payy said it followed incident response protocols and promised further updates as it works to restore functionality. It emphasized that it is investigating the cause of the exploit and will share more details when available.

The firm has not provided a timeline for when deposits, withdrawals, transfers or card operations will resume, nor has it released an estimate of customer losses stemming from the bridge drain. It also did not specify a technical cause for the exploit in its initial announcement.

Why it matters

The incident highlights the vulnerability of cross-chain bridges that underpin many crypto payment products. A single exploit can halt not only token transfers but also ancillary services such as debit cards, leaving users unable to access funds.

Until Payy clarifies the full extent of the loss and restores its network, the episode serves as a reminder of the operational risks tied to bridge infrastructure in decentralized finance. It also underscores the importance of transparent communication when a service interruption affects both asset movement and everyday spending.