Crypto Hacks: Three Projects Hacked in One Day as Losses Hit Over $11M

​Three crypto projects were attacked on September 24, suffering combined losses of more than $11M. Attackers drained around $1.8M from Payy Network, stole $7M from Duelbits, and minted $2.3M in unbacked tokens on the Meter network; these three are the latest crypto hacks to hit the industry.

The incidents affected different parts of crypto infrastructure, ranging from cross-chain bridges to private keys. Two of the three affected projects had already suffered major hacks in previous years.

Payy Network, which provides on-chain payroll and treasury management services, was the first to report an attack. Its Ethereum bridge was compromised, prompting the team to halt the network.

Confirming a ~$7M hack. Still investigating exactly what happened and how.

Until we have clarity, Duelbits stays offline. User funds are safe.

Next steps: finish the investigation, re-top hot wallets, and bring Duelbits back online, launch Duelbits 2.0.

I'll keep posting… https://t.co/V4Zl4St31I

— Joe (@DuelbitsJoe) September 24, 2026

Fresh Crypto Hacks: Payy Network and Duelbits Kose Nearly $9M

Onchain researcher Specter has identified suspicious transactions originating from the Payy Network bridge. The attacker initially acquired funds through the privacy protocol Railgun and subsequently swapped the stolen $1.8M in USDC for Ethereum.

Payy Network later confirmed that the attacker had completely drained the bridge’s balance. The company said the funds involved were non-custodial deposits belonging to Payy Network and Payy Wallet users, but it has not disclosed the exact cause of the exploit.

The attacker’s next target was the cryptocurrency gambling and betting platform Duelbits. PeckShield initially estimated the losses at $4.3M, but Specter later found additional affected addresses on the Bitcoin and Solana networks, revising the estimate first to $4.9M and then to $5.9M.

A Duelbits co-founder eventually reported losses of around $7M, most likely due to a compromised private key. In 2024, the platform faced another attack and lost $4.6M, which CertiK also linked to a potential private key leak.

We have finished initial root cause analysis of the exploit and are working with a top audit firm to validate it before releasing.

It was NOT a compromised key, social engineering or exploit of our off-chain infrastructure.

We aim to have a fully validated report to share in… https://t.co/6p8CM0n3gd

— Payy (@payy_link) September 25, 2026

Earn $50 and Enter $300K Prize Draw on EdgeX

Meter Attack Sends Two Tokens Plunging

The third affected project was the EVM blockchain Meter.io. Unlike the Payy Network attack, where the hacker drained existing bridge reserves, this hacker exploited a flaw in block verification to mint unbacked tokens.

According to Blockaid, the attacker created about $2.3M in assets and then sold them through the decentralized exchange PancakeSwap.

The Meter team said it preserved the network’s state, but it still hasn’t determined how to fully restore it. The sale of these unbacked assets drove sharp declines in Meter-related tokens; MTR lost nearly 80% of its value, while MTRG fell by about 75%. Previously, in 2022, the project suffered a bridge exploit that caused losses of about $4.4M.

This series of attacks coincided with a larger incident involving Bitget, which reported unauthorized asset transfers totaling about $351.6M from a limited number of wallets.

In response, Bitget temporarily suspended withdrawals while conducting security checks. However, trading and deposits continued normally, and user balances displayed correctly. The company is currently investigating the incident and analyzing the movement of the funds.

Earlier, we reported that KelpDAO filed a lawsuit against LayerZero and its co-founder, Brian Pellegrino, regarding a $292M hack. KelpDAO claims undisclosed risks and shortcomings in LayerZero’s technology caused the attack.

Discover: The Best Token Presales