Chainflip Lost More Than 736,000 USDT Due to a Vulnerability in Its Tron Integration

• An attacker withdrew 736,442 USDT across six transactions.
• The root cause was an error in processing transaction memos on the Tron network.
• Chainflip halted operations and promised to compensate affected users for their losses.

Cross-chain protocol Chainflip reported an attack on its USDT handling mechanism on the Tron network. The attacker withdrew 736,442 USDT. The team called it the first serious security incident that resulted in a loss of funds from the project’s vaults.

Another user transaction for 115,654 USDT was not completed. Those funds remain in the vault and can be paid out after operations resume. According to Chainflip, other assets were not affected.

Incident Details

The issue stemmed from the transaction memo processing mechanism on Tron. The attacker was able to modify the memo in a transaction that had already been signed by network participants. 

Chainflip’s system treated it as a new swap and then initiated a refund. As a result, the same deposit was effectively paid out twice.

The attacker repeated this scheme for about 90 minutes. In total, they made eight attempts, six of which were successful. The vulnerability affected only USDT transactions on the Tron network.

Chainflip halted the network and prepared a fix. According to the project, September 14 is the earliest possible date for operations to resume. The team also promised to fully compensate affected users for their losses.

MOCA said it has suspended all operations routed through Chainflip. At the same time, user funds on the platform’s side were not affected. Project representatives noted that Chainflip managed to isolate the issue to one swap direction and expressed support for the team.

Previously, we reported that the Fogo blockchain halted operations after a cybersecurity incident. 

Сообщение Chainflip Lost More Than 736,000 USDT Due to a Vulnerability in Its Tron Integration появились сначала на INCRYPTED.