Payy Network L1 Rollup Bridge Forged Withdrawal

At 04:21:23 UTC on September 24, 2026, Payy Network's RollupV1.verifyRollup function — which performs no deposit accounting and has no withdrawal cap — processed a forged withdrawal message with an all-zero burn hash, signed by Payy's own compromised prover key. The attacker had only deposited 10 USDC on L1 prior to the exploit, ruling out any user-side deposit accounting bug. A first batch of 1,828,589.38 USDC was withdrawn to Exploiter 1, followed by a second batch of 90,202.82 USDC. Funds were forwarded to a secondary address (Exploiter 3, officially labeled by Etherscan) and swapped in six tranches via the Rizzolver/Uniswap X solver contract, a Wintermute-affiliated settlement system. Payy removed the compromised prover/validator keys following disclosure and began a recovery process.