Payy Network's Ethereum L1 rollup bridge (RollupV1) was exploited and drained of approximately $1.83 million in USDC through a forged withdrawal hidden in a valid batch. The attack exploited the absence of deposit accounting, withdrawal caps, or pause mechanisms in the contract, with the attacker depositing only $10 while withdrawing $1.83 million using a compromised prover or validator key.