# "post-mortem" (exploit OR hack) — X 热门讨论 (2026-09-29 22:24 UTC)
## @payy_link (Payy) · 09-29 21:30 · ♥23 ↻0 💬5 Post mortem for the September 24th, 2026 exploit of Payy's bridge contract.
Based on our investigation, it appears that an attacker submitted an invalid burn proof that Payy’s deployed Noir/Barretenberg verifier accepted.
The first burn released 1,828,589.378132 USDC from the Payy rollup even though it appears that the transaction was invalid. A second burn of 1 USDC was paid early by a burn substitutor and later reimbursed. The second transaction released 90,202.820016 USDC to the same receiving wallet.
It appears there was a proving-system vulnerability in the Noir/Barretenberg verifier, developed by Aztec.
Full report: https://t.co/lrMEhQuKhO > 引用 @payy_link: Today at 4:21 UTC Payy’s bridge contract on Ethereum was exploited and drained of its full balance.
Investigation is ongoing and we are following incident response guidelines.
While we investigate, all Payy Network transactions are paused including deposits, withdrawals, transfers and card transactions.
We will continue to communicate updates here. https://x.com/payy_link/status/2105047468639658317