Crypto and DeFi projects continue to be hacked at a dizzying pace, and few days in recent weeks have been incident-free.
That said, Thursday was a particularly busy day, with three projects hit for a total of more than $11 million worth of crypto.
By the end of play, Payy Network had lost $1.8 million, Duelbits $7 million, and Meter $2.3 million.
Payy Network
The bridge connecting Payy Network, a rollup which offers on-chain payroll/treasury services, and Ethereum was first to be hit.
Pseudonymous on-chain investigator Specter first flagged suspicious withdrawals in a message to its Telegram group. Funded via privacy protocol Railgun, the attacker swapped $1.8 million of USDC for ETH.
The firm later confirmed the exploit, which drained the entire balance of its bridge, and paused all operations. It then clarified that the funds were “users’ non-custodial deposits to Payy Network/Payy Wallet,” but is yet to disclose the cause of the loss.
Read more: Across, Allbridge, TeleSwap lost $5.7M to bridge hacks in past week
Duelbits
Crypto casino and sports betting platform Duelbits was next up in a suspected private key compromise.
The estimated losses stacked up from blockchain security auditor PeckShield’s first tally of $4.3 million. Specter upped the ante to $4.9 million and then $5.9 million after identifying affected addresses on Bitcoin and Solana.
Duelbits’ own co-founder put the final number at approximately $7 million.
Read more: $2M stolen in triple attack on Fetch.ai, NuNet, and SingularityNET
The project was previously hacked for $4.6 million in 2024. At the time, auditor CertiK also suspected the loss to be due to a private key compromise.
Meter.io
EVM blockchain Meter.io also fell victim to a bridge attack, but this time, unbacked tokens were minted instead of existing deposits being drained.
Addressing the incident via X, the team pointed to a “block validation flaw” and informed users that “we’ve preserved the chain state. The recovery method is still to be decided.”
1/
— Meter.ioSecurity incident on Meter mainnet
On Sep 23 at 21:14 UTC, an attacker exploited a block validation flaw to mint unbacked MTR and MTRG, dump them on DEXs, and bridge funds out.
Mainnet and the bridge are paused. Please stop all activity on Meter.(@Meter_IO) September 24, 2026
Tokens worth a reported $2.3 million were minted out of thin air before being dumped on the PancakeSwap decentralized exchange.
The sales crashed the price of both MTR and MTRG tokens, which are down almost 80% and 75%, respectively.
Meter has also been hacked before, for $4.4 million back in 2022, in what was also a bridge hack.
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.
The post DeFi hack attack: Three exploits snatch $11M in a single day appeared first on Protos.
