Chainflip interrompt le réseau après une faille de mémo TRON USDT déclenchant 736,442 $ de paiements non autorisés

BITZ0 · 2026-09-16T07:44:14.000Z

Chainflip a déclaré le 15 septembre avoir corrigé la vulnérabilité TRON USDT à l’origine d’une attaque ayant vidé 736,442.17 USDT de son coffre TRON, et a détaillé un redémarrage réseau par étapes qui exclura initialement les échanges TRON. Le correctif est conçu pour empêcher les mémos joints aux appels de contrats enveloppés de générer des échanges ou des remboursements en double, selon la mise à jour du protocole. L’annonce fait passer l’incident d’un arrêt d’urgence vers un retour de service limité, tout en laissant la route TRON concernée hors du redémarrage initial.

Chainflip said on September 15 that it had patched the TRON USDT vulnerability behind an attack that drained 736,442.17 USDT from its TRON vault, and outlined a staged network restart that will initially exclude TRON swaps. The fix is designed to stop memos attached to wrapped contract calls from generating duplicate swaps or refunds, according to the protocol’s update.
The announcement moves the incident from an emergency halt toward a limited return of service, while leaving the affected TRON route out of the initial restart.
Chainflip restarts in stages without TRON swaps
Chainflip did not provide a date for the staged restart in its September 15 post. It said only that TRON swaps would be excluded initially as the network comes back online.
The patched behavior concerns memos sent with wrapped contract calls. Under the new handling, those memos can no longer cause a duplicate swap or refund, Chainflip said. The company’s description identifies that processing path as the source of the exploit rather than a broader loss across its funds.
Malformed TRON USDT memos produced duplicate payouts
The attacker withdrew 736,442.17 USDT between 01:44 and 03:10 UTC on September 12 by causing six liquidity-provider withdrawals to be paid twice, Chainflip said in the later update.
Chainflip’s initial incident account, published September 13, said the attacker attached a malformed memo to an already signed transaction. The system read the transaction as a failed swap and issued a refund, producing a second payout alongside the original withdrawal.
The attacker attempted the technique eight times over roughly 90 minutes, according to that earlier Chainflip disclosure. Six of those attempts resulted in double-paid LP withdrawals.
Chainflip Post-Exploit Restart Procedure, dated September 15, 2026. — Source: Chainflip
Pending user swap and reimbursement commitment
Chainflip’s September 13 update said one pending user swap worth 115,654.41 USDT remained in the vault.
It said other funds were unaffected and that affected users would be made whole.
The supplied updates did not specify a timetable for either resolving the pending vault swap or completing compensation; the statements are Chainflip’s own accounting of the incident and reimbursement commitment.
Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.