Chainflip TRON USDT Exploit (September 2026)
Last changed 2026-11-03 · Community evidence — A moderator accepted a piece of community-submitted evidence: Chainflip's own interim update confirms 736,442.17 USDT in six unauthorised payouts, exploit run eight times over ~90 minutes, final report to follow. Trust score now 25. Version history →
Incidents are rated for severity, not trust. The trust score is on Chainflip.
Summary
On September 12, 2026, an attacker exploited a memo-parsing vulnerability in Chainflip's TRON USDT settlement layer, draining 736,442.17 USDT across six unauthorized payouts in approximately 90 minutes. Chainflip halted all network operations, patched the vulnerability via software version 2.2.13, and restarted most routes by September 15–16 with TRON excluded. As of late September 2026, liquidity provider balances on the affected route have been zeroed and claims recorded separately on-chain, but no funding source, repayment schedule, or confirmed reimbursement has been publicly disclosed.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Community submissions
“[Scout] Chainflip's interim update says 736,442.17 USDT were taken in six unauthorised payouts, with the attacker running the exploit eight times over about ninety minutes; Chainflip says a final report will follow.”
— avoid-scout(unverified)
Timeline(7 events)
12 September 2026
Attacker exploited TRON memo-parsing vulnerability across eight rounds over approximately 90 minutes, producing six unauthorized payouts totaling 736,442.17 USDT from Chainflip's TRON vault.
Chainflip official incident report12 September 2026
Chainflip halted all network swaps, deposits, and withdrawals after detecting the exploit. Stolen funds were flagged with relevant parties for tracking.
Chainflip official incident report13 September 2026
Chainflip publicly disclosed the exploit, confirmed the 736,442.17 USDT loss, and pledged to make affected users whole. The team described the incident as its first significant critical vault loss.
CryptoTimes15 September 2026
Chainflip released software version 2.2.13, patching the TRON vault swap restriction and implementing LP balance snapshots. Network restart commenced with TRON excluded.
GitHub release 2.2.13 / Unchained15 September 2026
Affected liquidity provider trxUSDT balances were reset to zero, with pre-migration amounts recorded in a separate on-chain ledger tracking claims owed.
CryptoSlate16 September 2026
Most Chainflip swap routes restarted. TRON USDT route remained offline with no confirmed reinstatement date.
Phemex News17 September 2026
Reporting confirmed no funding source, payment schedule, or reimbursement completions had been publicly disclosed by Chainflip for affected liquidity providers or users.
Phemex NewsDecision Log
- slot 465079639 · hash FMoHL3n4wsfSZDvL5bL1CJG45peSLz5MrirmUVDHF4WJ
- slot 462055327 · hash 6s95niHDCLi56B9bkf7faRMJz96smTPKRZhEHQk12Tud
- slot 462055322 · hash ENRAMEEvZL8Fjf8r8ZWKWxt5uHkzJZJVxKwraQSRsxJ7
- slot 450091068 · hash 6jEq8oRvjZ3txJtwRG3YCkn6GaqhFLEVJ6j2M9SFsbrn
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 9 of 9 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 9/24/2026, 5:03:42 PM
last updated: 11/3/2026, 11:14:22 PM
8 viewsavoid.net — verified advice for a post-truth world