← Payy Networkreviewed 2026-11-04 · 9 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Payy Network against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
confirmed 90 corrections pending · 0 applied
confirmed
9 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: September 2026 bridge drain
“Unchained reports that on 2026-09-24 at about 04:21 UTC the Payy Ethereum bridge was drained in a first batch of 1,828,589 USDC, leaving about $95,000, followed about five hours later by a second payout of 90,202 USDC, for about $1.92M in total.”
reviewerBridge drained 2026-09-24 ~04:21 UTC in a first batch of 1,828,589 USDC, ~$95,000 left, second payout of 90,202 USDC ~five hours later, ~$1.92M totalMatches Unchained; the $1.83M alternate figure is also reported by Crypto Briefing. - #2[confirmed][no action needed]in section: September 2026 bridge drain
“Both payouts went through the verifyRollup function, and Unchained reports they were submitted by the address that normally posts Payy's batches (0x5343...3D38), whose recent transactions were all verifyRollup calls.”
reviewerBoth payouts via verifyRollup, submitted by the usual batch-posting address 0x5343...3D38; ~683 ETH via UniswapXSupported. Crypto Briefing attributes the 683 ETH conversion to Railgun tracing by Specter, a minor difference in routing detail that the page attributes correctly to Unchained. - #3[confirmed][no action needed]in section: September 2026 bridge drain
“Payy confirmed the funds were users' non-custodial deposits. Payy paused the network and wallet and said it flagged attacker addresses to law enforcement, exchanges and analytics firms.”
reviewerPayy confirmed funds were users' non-custodial deposits; paused network and wallet; flagged addresses to law enforcement, exchanges and analytics firmsSupported. - #4[confirmed][no action needed]in section: Cause and related security advisory
“Payy's initial analysis, as quoted by Unchained, found the drain was not a compromised key, social engineering or an exploit of off-chain infrastructure; it said it was checking findings with an unnamed audit firm.”
reviewerPayy's initial analysis found not a compromised key, social engineering or off-chain exploit; checking with an audit firmSupported. - #5[confirmed][no action needed]in section: Cause and related security advisory
“CVE-2026-48100 (published 2026-09-28; CVSS 4.0 score 8.7) describes a flaw in Payy's own agg_agg circuit, which did not check that the unused tail of its public messages array was zero, so a registered prover could insert an extra burn message that verifyRollup() would process, moving USDC out of the rollup contract.”
reviewerCVE-2026-48100 published 2026-09-28, CVSS 4.0 8.7, agg_agg flaw, versions before 1.3.0 affected, allowlisted prover noteAccurate. The page appropriately hedges that the CVE is not confirmed as the cause. - #6[confirmed][no action needed]in section: Cause and related security advisory
“Crypto Briefing reports an earlier June 2026 zk-circuit flaw was patched in v1.3.0 'before any funds were lost'.”
reviewerCrypto Briefing reports an earlier June 2026 zk-circuit flaw patched in v1.3.0 before any funds were lostCorrectly attributed; the page notes the tension with the Sept drain. - #7[confirmed][no action needed]in section: User compensation
“DiarioBitcoin, in an article dated 2026-10-13 that relays reporting by Odaily as carried by KuCoin, says Payy opened a claims process: claims accepted for 30 days, eligible cases to be compensated in USDC on Ethereum, and the Payy Wallet suspended and expected to close after the claims period.”
reviewerDiarioBitcoin 2026-10-13 relays Odaily via KuCoin: 30-day claims, USDC on Ethereum, wallet suspended and to close after claims period; no eligibility criteria givenAccurate and appropriately caveated as secondhand. - #8[confirmed][no action needed]in section: User compensation
“Early coverage (Unchained, Crypto Briefing) said Payy had not stated whether users would be repaid.”
reviewerEarly coverage said Payy had not stated whether users would be repaidSupported. - #9[confirmed][no action needed]in the timeline
“CVE-2026-48100 published for the Payy agg_agg circuit soundness flaw, fixed in v1.3.0.”
reviewerTimeline: CVE published 2026-09-28; claims reporting 2026-10-13; drain 2026-09-24Timeline entries are consistent with sources.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.