Three crypto projects — Payy Network, Duelbits, and Meter.io — were hacked on Thursday, losing over $11 million combined.
Attacks on crypto and decentralized finance projects keep occurring at a rapid rate, with hardly a day passing without an incident recently.
Nevertheless, this Thursday stood out as three separate projects suffered losses totaling over $11 million in cryptocurrency.
The tally by day's end showed Payy Network down $1.8 million, Duelbits down $7 million, and Meter down $2.3 million.
The first target was the bridge linking Payy Network — a rollup providing on-chain payroll and treasury services — with Ethereum.
An on-chain sleeper known as Specter initially brought attention to unusual withdrawals in a Telegram message. The exploiter, whose funds came through the privacy tool Railgun, converted $1.8 million in USDC into ETH.
Payy later acknowledged the breach, stating it had emptied the bridge's entire holdings. Operations were halted. The company added that the stolen money consisted of users' non-custodial deposits, while the root cause remains undisclosed.
Today at 4:21 UTC Payy's bridge contract on Ethereum was exploited and drained of its full balance.
— Payy (@payy_link) September 24, 2026
Investigation is ongoing and we are following incident response guidelines.
While we investigate, all Payy Network transactions are paused including deposits, withdrawals,…
Next came Duelbits, a crypto casino and sportsbook, which was believed to have suffered a private key leak.
PeckShield, a blockchain security auditor, initially put the loss at $4.3 million. Specter later raised the figure to $4.9 million and then to $5.9 million after spotting compromised wallets on Bitcoin and Solana.
The co-founder of Duelbits ultimately estimated the damage at roughly $7 million.
Confirming a ~$7M hack. Still investigating exactly what happened and how.
— Joe (@DuelbitsJoe) September 24, 2026
Until we have clarity, Duelbits stays offline. User funds are safe.
Next steps: finish the investigation, re-top hot wallets, and bring Duelbits back online, launch Duelbits 2.0.
I'll keep posting… https://t.co/V4Zl4St31I
In 2024, Duelbits had already been targeted for $4.6 million. CertiK, another auditor, then also attributed that incident to a private key exposure.
Meter.io, an EVM-compatible blockchain, was also hit by a bridge exploit, though in this case the attacker created unbacked tokens rather than siphoning existing deposits.
In a statement on X, the Meter team cited a 'block validation flaw' and said the chain state had been preserved, with a recovery plan still to be determined.
1/
— Meter.io (@Meter_IO) September 24, 2026
Security incident on Meter mainnet
On Sep 23 at 21:14 UTC, an attacker exploited a block validation flaw to mint unbacked MTR and MTRG, dump them on DEXs, and bridge funds out.
Mainnet and the bridge are paused. Please stop all activity on Meter.
According to reports, around $2.3 million in tokens were fabricated and then sold on the decentralized exchange PancakeSwap.
The selling pressure sent MTR and MTRG tokens plummeting roughly 80% and 75%, respectively.
This is not the first time Meter has been exploited; in 2022 it lost $4.4 million in a similar bridge attack.
Share to
Disclaimer: this article comes from third-party media and is provided for reference only. It does not constitute investment advice. Crypto and other financial products carry significant price volatility risk, so please make your own decisions carefully.
Misha Komarov from alloc/init discussed Shielded Bitcoin, a research concept using zero-knowledge proofs to hide transaction details, requiring no soft fork.
HSBC named its Hong Kong dollar stablecoin RedCoin, set to launch in H2 2026 via PayMe and HSBC HK app, but key details are missing.
MicroStrategy's Michael Saylor supports competitor Strive, saying its Bitcoin purchases benefit the broader sector. The firms also share financial ties.
An error at Gate charged a stock dividend to the wrong contract, wiping out shorts and leaving one account $1.5M in the red. Gate says it will cover losses.