A single transaction on Ethereum moved about $1.83 million in USDC out of a contract belonging to Payy Network early on Thursday. The blockchain investigator Specter flagged it, saying the privacy payment network may have been drained.
Payy has said nothing. The transaction is confirmed on-chain, and its destination matches an address the investigator has listed as connected to the incident, but no cause has been established, no exploit has been confirmed by the protocol, and the two open questions—what happened and how much in total is gone—remain unanswered.
The transaction was confirmed in Ethereum block 26044909 at 04:21:23 UTC on September 24, 2026. Specter Investigation published its findings later that morning, saying the “Payy Network Roll up may have been drained of $1.8M in USDC.”
What the Transaction Shows
The transaction called a function named verifyRollup on a Payy contract and moved 1,832,149.4681 USDC out of the address 0x367c1eaF14AA06b78ce76bd0243297de79d85270.
Almost all of it went to one place. The address 0xAa4985dBDaBfACa344237D40F7E06C4a0BB57E70 received 1,828,589.3781 USDC. Two smaller transfers of 3,165.71 USDC and 394.31 USDC went to separate addresses. Together the three account for the full outflow.
That largest recipient appears on the list of addresses Specter published. Its post named five:
- 0xb483B1742aaD0a60a9FC91bb36C5a42dbE3F3D38
- 0xa3dD31d9aD9A7eCAC68c2d2cF6063DfEa7bA3cAe
- 0xe8d566E2f914dbd8309625e1792ed21fD0431956
- 0xAa4985dBDaBfACa344237D40F7E06C4a0BB57E70
- 0x3d092740936dA4C5693DaE3633c7207A37F40104
The transaction succeeded and was not reverted. It carried no ether value and cost about $2.33 in fees.
What Specter Says Happened Next
According to Specter, the person behind the transfers funded the operation through Railgun, a privacy protocol that obscures the origin of funds, then swapped the USDC for ethereum and distributed the proceeds across three addresses.
A flowchart published alongside its findings shows funds arriving from Payy Network and from Railgun into an intermediate address, then moving out as ether in amounts including roughly $534,000, $754,000, and $134,000.
The Crypto Times has verified the USDC transfer out of the Payy contract and the receiving address independently against Ethereum records. The Railgun funding and the subsequent ether distribution are Specter’s findings and have not been independently confirmed here.
What Payy Is
Payy describes itself as a privacy-focused payment network for stablecoins, built as a zero-knowledge rollup on Ethereum. A rollup processes transactions off the main chain and posts compressed proofs back to it, which is how it achieves lower costs while inheriting Ethereum’s security.
The verifyRollup function the transaction called is part of that machinery: the mechanism by which a rollup’s state is verified on the main chain. Naming the function is not the same as knowing what went wrong with it, and nothing on-chain establishes whether this transaction was authorized.
What Is Not Known
Payy has made no public statement about the transfer and has not confirmed a security incident. Nobody has established a cause, whether any user funds were affected or whether the $1.83 million represents the full extent of any loss.
Specter’s own wording is conditional: the network “may have been” drained. Several outlets have since reported the incident as a confirmed hack. No confirmation from the protocol has been published.
The Crypto Times contacted Payy Network for comment at 10:45 AM UTC and will update this report once it receives a response.
Also Read: SingularityNET Bridge Hack Widens: 260M AGIX, 53.8M WMTx Minted, $16.77M Held by Attacker
