Payy hack: the 682 ETH went into Tornado Cash, but 90,202 USDC is still on the exploiter’s wallet
PublicAML · On-chain investigation · 30 September 2026
On 24 September 2026 Payy’s bridge on Ethereum paid about 1.92 million USDC to a single address. Payy’s post-mortem puts it down to its Noir/Barretenberg verifier accepting an invalid burn proof. We followed the money to the end. The first payout, 1.83 million USDC, was swapped to about 683 ETH within minutes and split into three wallets; on 26 September all of it went into Tornado Cash within about an hour. The second payout, 90,202 USDC, has not moved: it is still on the exploiter’s wallet, and as of 30 September Circle has not frozen it.
1.92M USDC
paid out by the bridge on 24 Sep, in two batches
~682 ETH
into Tornado Cash on 26 Sep, 06:09–07:17 UTC
90,202 USDC
still on the exploiter’s wallet, not frozen
Railgun
where the exploiter’s first gas came from, 22 Sep
What happened
Payy runs a privacy rollup with a bridge contract on Ethereum, 0x367C1eAF14AA06b78ce76bd0243297de79d85270. The bridge releases USDC when it is shown a valid proof that the same amount was burned on the rollup. According to Payy’s post-mortem, the deployed verifier accepted a proof that was not valid, so the bridge paid out money that had never been burned: 1,828,589 USDC at 04:21 UTC on 24 September and another 90,202 USDC at 09:30, both to 0xAa4985dBDaBfACa344237D40F7E06C4a0BB57E70.
Both payouts were included in Payy’s own rollup batches, so the Ethereum transactions were sent by Payy’s operator, not by the exploiter. That address has submitted thousands of routine batches; it is not the attacker, and we do not treat it as one.
The exploiter prepared in advance. The wallet received its first ETH for gas — 0.005 ETH — from Railgun, a privacy protocol, at 11:29 UTC on 22 September. The same day and the next it put 5 USDC into the bridge twice, the ordinary way, as a test.
Where the money went
One minute after the first payout the exploiter moved the 1.83 million USDC to 0xb483B1742aaD0a60a9FC91bb36C5a42dbE3F3D38, which sold it through UniswapX for about 683 ETH. Between 05:20 and 05:38 UTC that ETH was split three ways: 282.4 ETH to 0xe8d566E2f914dbd8309625e1792ed21fD0431956, 200 ETH to 0x888A21c48cF442e312bddd7c24B678f0C7132a2a and 200 ETH to 0x3d092740936dA4C5693DaE3633c7207A37F40104. Unchained reported the trail up to this point.
The three wallets then waited for two days. On 26 September, starting at 06:07 UTC, each passed its ETH one hop further — to 0xF46e1e8Ca9a032f1C84b1451890ad0aedb5E0BeD, 0x2072f325f0Bb7e06c1D7C933a10886f794D4CC99 and 0x21D4A32a357c77e72dCe79810d54C7FCf5A19969 — and those wallets deposited it into Tornado Cash: 180 ETH, 302 ETH and 200 ETH, the last at 07:17. None of the three split wallets or hops holds anything now.
The wallets around this exploit are being sent fake USDC and "ETH" tokens from look-alike addresses (0xb483…, 0xe8d5…, 0x888…), and some explorers list those transfers alongside the real ones. That is address poisoning aimed at anyone copying an address from the history; it is not part of the trail and is not counted here.
| When (UTC, 2026) | From | To | Amount | Tx |
|---|---|---|---|---|
| 24 Sep 04:21 | 0x367C1e…d85270 | 0xAa4985…B57E70 | 1,828,589 USDC bridge payout on an invalid proof | 0xf43abd…1e1814 |
| 24 Sep 09:30 | 0x367C1e…d85270 | 0xAa4985…B57E70 | 90,202 USDC second payout — still on this wallet | 0xda88fb…4858c8 |
| 24 Sep 04:22 | 0xAa4985…B57E70 | 0xb483B1…3F3D38 | 1,828,595 USDC to the swap wallet, sold via UniswapX | 0xb2fd99…ca10e7 |
| 24 Sep 05:20–05:36 | 0xb483B1…3F3D38 | 0xe8d566…431956 | 282.4 ETH split wallet | 0x798745…f09b95 |
| 24 Sep 05:37 | 0xb483B1…3F3D38 | 0x888A21…132a2a | 200 ETH split wallet | 0xd2ef52…074f1a |
| 24 Sep 05:38 | 0xb483B1…3F3D38 | 0x3d0927…F40104 | 200 ETH split wallet | 0x0b41b6…289a9e |
| 26 Sep 06:09–06:19 | 0xF46e1e…5E0BeD | 0xd90e2f…24F31b | 180 ETH into Tornado Cash | 0x1cfb68…5a9cf6 |
| 26 Sep 06:46–07:00 | 0x2072f3…D4CC99 | 0xd90e2f…24F31b | 302 ETH into Tornado Cash | 0xe5dfd9…b6dbf2 |
| 26 Sep 07:16–07:17 | 0x21D4A3…A19969 | 0xd90e2f…24F31b | 200 ETH into Tornado Cash | 0x0415dc…cf64f4 |
What can still be frozen
The second payout, 90,202.82 USDC, has not moved since it arrived at 09:30 UTC on 24 September. It sits on 0xAa4985dBDaBfACa344237D40F7E06C4a0BB57E70. USDC is issued by Circle, which can freeze an address; on 30 September we checked the USDC contract directly and this address is not blacklisted. The ETH is gone into Tornado Cash, but this part of the money is still recoverable.
What this page does not say
It names nobody. It does not say who controls the exploiter’s wallet, and the Railgun deposit that funded its gas cannot be traced to a person from public data.
The technical cause is Payy’s own account from its post-mortem; we checked the payouts and the flow of money, not the verifier code.
All eight exploiter addresses on this page are listed on our incident page for this event, so anyone checking one of them finds the case.
Sources: Ethereum chain data (Blockscout) read on 30 September 2026, and the USDC contract’s isBlacklisted checked directly on that date; Payy’s post-mortem for the cause; Unchained’s report for the first hops. Dollar values at the late-September ETH price. This is an information resource about transactions between addresses, not financial or legal advice, and it names no individual as responsible for anything.