Payy Network Suffered $1.92 Million USDC Theft
The platform suspended all user transactions following the breach on Sept. 24.
Updated on Oct. 13, 2026 in Cybersecurity
Live Poll
Do you trust cryptocurrency platforms to handle sensitive wallet keys during a recovery process?
The Payy blockchain network lost $1.92 million in USDC during an attack that occurred on Sept. 24, 2026. Following the breach, the firm suspended all deposits, transfers, and card payments for its users.
Why it matters
Payy is currently unable to independently confirm user holdings, forcing the platform to request mnemonic phrases or private keys from account holders to verify compensation claims. The firm has opted for this manual verification process because it cannot rely solely on the Aztec ZK framework, which contains known and potential vulnerabilities.
The theft involved $1.92 million in USDC assets extracted from the Payy Ethereum rollup on Sept. 24. Security concerns now center on the Aztec ZK framework, which the platform acknowledges has known and potential vulnerabilities preventing automated verification.
The players
Payy
Payy is a blockchain network that utilizes an Ethereum rollup and the Aztec ZK framework to facilitate digital transactions and card payments.
The details
The platform now requires users to submit mnemonic phrases or private keys to verify account balances and process compensation claims. This manual verification process also incorporates identity information to mitigate the risk of fraudulent submissions following the system-wide suspension of services.
Timeline
The attack on the Payy network took place on Sept. 24, 2026.
The Tech Race
This incident highlights the limitations of the Aztec ZK framework and demonstrates how a vulnerability in zero-knowledge infrastructure forces a return to legacy security practices. It underscores the ongoing struggle to balance privacy-focused verification tools with robust protection against sophisticated network exploits.
Users currently face a complete suspension of their ability to make deposits, transfers, or card payments on the Payy platform. Those seeking compensation must be prepared to submit private keys or mnemonic phrases, which requires significant care to prevent further account compromise.
The takeaway
Users should exercise extreme caution when asked to provide sensitive credentials like mnemonic phrases or private keys for verification purposes. Always verify the authenticity of a claim process directly through official channels before sharing any information that could lead to the permanent loss of assets.
Further reading
For more information on current digital security threats, visit the Cybersecurity section.
Source note: This article includes information reported by TokenPost.
Live Poll
Do you trust cryptocurrency platforms to handle sensitive wallet keys during a recovery process?
