Chainflip Reports Tron USDT Attack, Says 736,442.17 USDT Was Stolen

Cross-chain protocol Chainflip said it disclosed an attack on Tron USDT that occurred yesterday. According to Odaily, 736,442.17 USDT was stolen through six unauthorized payments, while 115,654.41 USDT from failed user swaps remained in the vault. Chainflip said the attacker exploited a vulnerability in Tron’s transaction memo mechanism by attaching a custom memo to validator-signed transactions, causing the system to treat the same deposit as a separate swap and issue a refund again. The attacker carried out eight actions over about 90 minutes and gradually increased the amount. Chainflip said it has completed a fix, marked the stolen funds with relevant agencies in an effort to recover them, and expects to resume operations as early as Monday. It also said it will cover losses for affected users.