Three DeFi Hacks, One Day: Payy Loses $1.8M, Duelbits $7M, Meter $2.3M

Three separate crypto platforms were hacked within roughly 24 hours on September 24, 2026, with combined losses topping $11 million. Payy Network lost $1.8 million from its Ethereum bridge, crypto casino Duelbits lost about $7 million, and the Meter network lost $2.3 million. Both Cryptonews and Protos independently reported the same three incidents and the same headline figures, which is the threshold Cryptaur treats as confirmed rather than single-sourced.

What is not yet confirmed by two independent sources is the exact mechanism behind the Meter loss. One outlet described it as unbacked tokens being minted on the network; the other reported only the $2.3 million total without detailing how it happened. Readers should treat the total as verified and the mechanism as provisional until Meter itself publishes a post-mortem.

Payy’s Bridge Drained in Minutes, Cause Still Undisclosed

Payy Network operates a rollup offering on-chain payroll and treasury services. Its bridge to Ethereum was the first hit. Pseudonymous on-chain investigator Specter flagged suspicious withdrawals in the project’s Telegram group before Payy confirmed the exploit.

According to Payy’s own statement, the attacker was funded through privacy protocol Railgun and swapped $1.8 million of USDC for ETH. The bridge contract was drained of its full balance at 4:21 UTC. Payy paused all deposits and withdrawals and said the affected funds were “users’ non-custodial deposits to Payy Network/Payy Wallet.” The team has not yet disclosed the root cause of the drain.

Duelbits: A Loss Estimate That Moved From $4.3M to $7M

Duelbits, a crypto casino and sports-betting platform, was hit next in what is suspected to be a private key compromise. This is a case where watching the number change in real time tells its own story about verification speed on-chain.

Blockchain security auditor PeckShield put the initial tally at $4.3 million. Specter revised that estimate upward twice, to $4.9 million and then $5.9 million, after identifying additional affected addresses on Bitcoin and Solana. Duelbits co-founder Joe closed the loop with the final figure. “Confirming a ~$7M hack. Still investigating exactly what happened and how. Until we have clarity, Duelbits stays offline. User funds are safe,” he wrote. The company said its next steps are finishing the investigation, re-topping hot wallets, and relaunching as Duelbits 2.0.

Meter’s $2.3M Figure Is Confirmed, the Story Behind It Is Not

Meter rounds out the day’s total. Both outlets agree on the $2.3 million loss figure, which puts the combined damage from the three incidents above $11 million. Cryptaur has not seen a detailed technical account from Meter itself, and the mechanism reported by one outlet has not been independently corroborated in this batch of sources.

None of the three projects has published a full post-incident report as of this writing. Payy’s cause remains undisclosed, Duelbits is still investigating “exactly what happened and how,” and Meter’s mechanism sits on a single source. The confirmed figures, $1.8 million, $7 million, and $2.3 million, are what two independent outlets agree happened on September 24. Everything past those totals is still being pieced together.

Sources

• cryptonews.com
• protos.com