Chainflip Loses $736K in Tron USDT Exploit, Pauses Until Monday

Cross-chain swap protocol Chainflip disclosed on September 13 that an attacker drained 736,442.17 USDT from its Tron integration in the early hours of September 12, the first significant security incident to result in a loss of funds from Chainflip vaults.

The protocol, which lets users swap assets across multiple blockchains, has paused operations and expects to remain offline until at least Monday while it works through a technical restart plan.

How the exploit worked Chainflip reads swap instructions from a memo attached to Tron transactions, unlike most chains it supports that use dedicated contract functions.

The attacker found a way to attach their own memo to transactions that Chainflip validators had already signed. The system read that memo as a separate swap, treated it as a failed one, and issued a refund — meaning the same deposit ended up being paid out twice.