Chainflip Hack

On September 12, 2026, cross-chain swap protocol Chainflip suffered a memo-manipulation exploit on its Tron settlement layer, resulting in six unauthorized payouts totaling 736,442.17 USDT after an attacker attached custom memos to already-signed transactions to trigger duplicate refund payouts.

Unlike other blockchains supported by Chainflip that pass swap instructions via dedicated contract functions, the protocol's Tron integration parses swap parameters directly from transaction memo fields. The attacker discovered a vulnerability allowing a custom memo to be appended to a Tron transaction that Chainflip validators had already signed. Chainflip's backend misread the altered memo as a new, separate swap instruction, classified it as failed, and automatically triggered a refund, effectively paying out against the same underlying deposit a second time.

The attacker executed eight attempts over ~90 minutes in the early hours of Saturday, scaling up transaction sizes until six successful attempts extracted 736,442.17 USDT. Chainflip detected the incident after subsequent legitimate USDT payouts began failing due to drained vault reserves. Network operations were paused, a code fix was finalized, and operators committed to making all impacted users whole upon restart.