Payy, a network for private stablecoin payments, said on X on Friday that its initial root cause analysis found the drain of its Ethereum bridge “was NOT a compromised key, social engineering or exploit of our off-chain infrastructure,” and that it is checking the findings with an audit firm before releasing them. The bridge paid out about $1.92 million in USDC to a single address in two batches on Thursday, and Payy has confirmed the stolen funds were “users’ non-custodial deposits to Payy Network / Payy Wallet.” Its network and Payy Wallet are paused.

Payy first said that at 4:21 UTC on Sept. 24 its bridge contract “was exploited and drained of its full balance,” and that deposits, withdrawals, transfers and card transactions were on hold. Payy sells privacy-focused stablecoin payment tools, and its bridge is a rollup contract that settles the network’s activity on Ethereum.

Two Batches Emptied the Bridge

Ethereum records show the drain took two batches. The first sent 1,828,589 USDC to one address at 4:21 UTC, leaving about $95,000 in the bridge. About five hours later, at 9:30 UTC, a second batch paid another 90,202 USDC to the same address, leaving about $700.

Both payouts went through verifyRollup, the function through which Payy posts batches of network activity to its bridge, and both were submitted by the address that posts those batches. Every one of the last 200 transactions that address sent, going back to late August, was a verifyRollup call to the bridge.

The receiving address had used the bridge before. It deposited 5 USDC into Payy on Sept. 22, withdrew 5 USDC later that day and deposited another 5 USDC on Sept. 23.

Where the Money Went

Within about eight minutes, the first payout had been moved to a second address and sold through UniswapX for roughly 683 ETH. By 5:39 UTC, nearly all of that ether sat in three wallets. The second payout of 90,202 USDC was still in the receiving address as of Friday afternoon.

Payy said it had flagged the attacker’s addresses to law enforcement, exchanges and blockchain analytics firms, and it paused Payy Wallet, promising details on next steps for users. It said it aims to share a validated report “in the next few days.” Its posts do not give a loss figure or say whether users will be repaid or when the network will restart.

The drain came the same day Bitget said about $351.6 million was taken from its hot and warm wallets, in a separate incident.

Related Listen: Why the Crypto Market Cap Could Reach $50 Trillion This Cycle