hack or exploit

DeFi hack attack: Three exploits snatch $11M in a single day

0Importance
closedStatus
3News media
3Pieces
Published
Updated
Since then
2 new reports
In
DeFi

On September 24, three crypto projects were hit in separate incidents and the combined losses were reported at more than $11 million. The day’s largest theft was at Duelbits, while Payy Network and Meter also recorded losses.

Key claims & sources

✓
Payy Network lost $1.8 million in the same round of incidents.
✓
Three separate security incidents were reported on September 24, with combined losses above $11 million across Payy Network, Duelbits, and Meter.
✓
Duelbits recorded about $7 million taken from its hot wallets.
✓
Meter lost $2.3 million, and one writeup described the event as an exploit involving unbacked token minting on the Meter network.

What it means

Users and customers connected to these projects would see the impact immediately in the form of disrupted services or reduced confidence in how these systems handle funds. Anyone monitoring DeFi security would also notice that three projects were hit on the same day, with losses spread across Payy Network, Duelbits, and Meter.

In practice, the events show that funds could be drained from hot wallets at Duelbits, that Payy Network’s loss was tied to a bridge-related issue, and that Meter’s loss was tied to a verification flaw or unbacked token minting. What remains the same is that each incident is still being described as a separate security failure rather than one shared event.

Market reaction i

Total crypto marketall crypto assets combined no single asset in the event: read against the whole market
first headline
+0.9% 2 h before
-0.4% 4 h after
$2.9Tmarket cap at publication
12data points

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Sep 25 11:38
+6 h 47 m
Sep 25 18:25
Crypto Economy context
Its angle: vulnerabilities, verification, subsequently; with quotes
+2 d 1 h
Sep 27 13:30

Thefts of a similar size

WhenWhat happenedFigure
1.1 years ago UXLINK · Social engineering incident $11M
4.5 years ago Saddle Finance · Swap Logic Flaw incident $11M
5.4 years ago JBS · Ransomware incident $11M
5.5 years ago Value Defi · Cross contract reentrancy incident $11M
5.8 years ago YFI · Flash loan attack incident $11M

4282 incidents stored · 314 were as large as this one or larger ($11M)