Chainflip Hit by Tron USDT Exploit; 736,442.17 USDT Drained

Chainflip said it recently suffered an attack involving Tron-based USDT. The incident led to the loss of 736,442.17 USDT across six unauthorized transactions. Chainflip added that 115,654.41 USDT remains in its treasury after user swaps failed to execute, and that all other funds were not affected. According to Chainflip, the attacker abused a weakness tied to Tron's transaction memo mechanism. By attaching custom memos to transactions already signed by validators, the attacker tricked the system into treating a single deposit as multiple separate swaps, triggering duplicate refunds and repeated payouts. The attacker conducted eight operations over roughly 90 minutes, increasing the size of transactions over time. Chainflip said it has deployed a fix and has flagged the stolen funds with relevant authorities as it pursues recovery. The protocol expects to restart operations no earlier than Monday and said it will make affected users whole.