Crypto Security Breaches: $11M Lost in Triple Attack
Cross-chain bridges and private keys compromised in coordinated exploits
1Triple attack pattern
Three distinct crypto projects suffered simultaneous attacks on September 24, 2026, with combined losses exceeding $11M. Payy Network lost $1.8M through its compromised Ethereum bridge, gambling platform Duelbits reported $7M stolen via private key leaks, and Meter.io faced $2.3M in losses from fraudulent token minting. Each attack targeted different technical vulnerabilities, showcasing varied exploitation methods within crypto infrastructure. The incidents occurred despite two projects having prior security breach histories.
2Payy Network bridge drain
Attackers initially acquired funds through Railgun privacy protocol before draining Payy Network's Ethereum bridge of $1.8M in USDC, later swapped to Ethereum. The non-custodial deposits belonged to Payy Network and Payy Wallet users, though the exact exploit method remains undisclosed. The team halted network operations immediately after detection. This marks Payy's second major security incident, following previous undisclosed breaches. On-chain researcher Specter first identified suspicious transactions originating from the compromised bridge.
3Duelbits' escalating losses
Initial estimates placed Duelbits' losses at $4.3M, later revised to $7M as investigators discovered additional affected addresses across Bitcoin and Solana networks. The breach likely stemmed from compromised private keys, mirroring the platform's 2024 attack that lost $4.6M. Duelbits remains offline during investigation, though the team assures user funds are safe. The platform plans to relaunch as Duelbits 2.0 after replenishing hot wallets and completing security audits, indicating systemic vulnerabilities in their infrastructure.
4Meter.io's token manipulation
Unlike bridge exploits, Meter.io attackers manipulated block verification to mint $2.3M in unbacked tokens, later sold via PancakeSwap. This caused MTR to drop 80% and MTRG 75% in value. The team preserved network state but hasn't determined full recovery methods. Meter.io previously suffered a $4.4M bridge exploit in 2022, suggesting recurring security gaps. The current attack's sophistication highlights risks in blockchain consensus mechanisms beyond typical smart contract vulnerabilities.
5Security history repeats
Two of three attacked projects had prior major breaches: Duelbits lost $4.6M in 2024 to private key leaks, while Meter.io's 2022 bridge exploit cost $4.4M. This pattern suggests inadequate post-breach security overhauls in crypto projects. Payy Network's first reported breach indicates possible undisclosed incidents. The recurrence of similar attack vectors (bridges, private keys) across years points to persistent industry-wide vulnerabilities that remain unaddressed despite growing losses.
6Broader ecosystem impact
These attacks coincided with Bitget's $351.6M unauthorized transfers, though unrelated technically. The incidents collectively undermine trust in crypto infrastructure during a sensitive regulatory period. KelpDAO's $292M lawsuit against LayerZero over alleged undisclosed risks further compounds industry concerns. Such high-profile breaches may accelerate regulatory scrutiny and insurance premium increases for crypto projects, particularly those handling cross-chain transactions or operating gambling platforms.
7Response strategies diverge
Each project adopted different response protocols: Payy Network immediately halted operations, Duelbits went offline for investigation, while Meter.io maintained network state. Payy collaborates with audit firms to validate root causes, excluding key compromises or social engineering. Duelbits plans architectural overhaul with version 2.0. These varied approaches reflect the absence of standardized security playbooks in crypto, leaving projects to develop ad-hoc responses to breaches.
8Systemic vulnerability exposure
The triple attack reveals crypto's persistent weak points: cross-chain bridges remain prime targets, private key management systems prove unreliable, and consensus mechanisms contain unforeseen exploits. With cumulative losses exceeding $20M across these projects' histories, the incidents demonstrate how attackers continuously evolve methods to exploit both known and novel vulnerabilities. This may prompt institutional investors to demand higher security standards before allocating capital to crypto infrastructure projects.
Original article: News - Cryptonews — Crypto Security Breaches: $11M Lost in Triple Attack