Chainflip TRON Memo Replay Exploit — $736,442.17 USDT, Users Made Whole

On September 12, 2026, between 01:44 and 03:10 UTC, an attacker exploited a flaw in Chainflip's TRON USDT integration. A custom memo attached to a transaction already signed by the protocol's validators was processed as a separate, distinct failed swap, triggering a duplicate refund. The attacker repeated the exploit across 8 attempts over roughly 90 minutes, succeeding on 6, for a total of $736,442.17 USDT in unauthorized payouts. A legitimate user swap of 115,654.41 USDT that was pending at the time remained safe in the vault throughout. The network was paused following detection. Chainflip committed to making affected liquidity providers whole, resetting TRON-related balances to zero and tracking claims on-chain; the TRON route was excluded from the v2.2.13 restart published September 15. No destination address for the stolen funds has been publicly disclosed.