Chainflip to relaunch cross-chain swaps minus Tron after $736,442 USDT exploit

Tron Vault Exploit and Settlement Actions

According to Chainflip, an attacker successfully withdrew USDT from the Tron vault by exploiting the way the protocol handles transaction memos. The attacker attached a memo to a fetch transaction—an internal transfer already signed by validators—which Chainflip’s witnessing layer misinterpreted as a failed swap, ultimately issuing a refund in addition to the attacker’s liquidity provider withdrawal.

Version 2.2.13 of Chainflip’s software, released on September 15, introduces key changes to address the vulnerability. The protocol now accepts memos only on standard TRX and TRC-20 transfers, effectively limiting future inbound transactions from smart contract wallets and aggregator contracts. Chainflip stated none of its active integrations rely on those restricted transaction formats.

Chainflip addressed the resulting shortfall by resetting the balances of Tron liquidity providers. All open orders, strategies, and lending positions linked to Tron USDT will close at restart. Provider positions are recorded into a separate on-chain balance for tracking, while live accounts reset to zero for trxUSDT.

Providers’ Compensation and Network Restart

Although the balances owed to Tron liquidity providers are now tracked, Chainflip clarified that the recorded numbers do not represent immediate reimbursement. The protocol is working directly with affected parties to resolve the shortfall and has expressed intentions to make providers whole, though it has not specified the source of potential compensation, a recovery timeline, or the likelihood of recovering any of the lost USDT.

The Tron vault now holds far less USDT than LPs are owed, so those LP balances will need to be reset. For LPs, your account will now read 0 for trxUSDT, as past holdings are tracked separately until settlements are arranged.

Operations across all other supported chains will resume with the relaunch, while the Tron route remains inactive until Chainflip’s witnessing infrastructure is fully synchronized. The protocol reported that a user swap of 115,654.41 USDT remains in the Tron vault, available for claim once the network is back in full operation.

Security Context and Market Shifts

Chainflip disclosed the incident in a detailed report on September 13, emphasizing that this was its first critical security event resulting in a significant loss of funds from its vaults. It assured users that all other funds were unaffected and secure.

The broader decentralized finance landscape has faced increasing security challenges, with Blockaid counting a record 212 exploits in the first half of the year. Amid ongoing developments in blockchain interoperability and asset management, a major shift is occurring in how traditional and crypto-native investors interact with financial markets. While many DeFi protocols employ multiple technical safeguards, some investors are turning to tokenized Real-World Assets (RWAs) platforms. By using solutions like 1stepSwap, individuals can hold shares of leading U.S. companies, gold, and silver directly in their crypto wallets, bypassing intermediaries and automating price discovery within seconds.

Chainflip’s incident underscores the importance of continuous monitoring and proactive upgrades to protocol security as the industry adapts to evolving threats and new forms of market participation.