Chainflip paused operations after an attacker extracted approximately 736,400 USDT through six unauthorized payments involving its Tron integration in the early hours of Sept. 12. The attacker appended new memos to transactions already signed by Chainflip validators, causing the protocol to treat them as separate redemption instructions and issue duplicate refunds. The method was used eight times over roughly 90 minutes, beginning with small amounts and increasing in size. A legitimate 115,654.41 USDT user swap remains in Chainflip's vault and can be processed after the network restarts. Chainflip said remaining funds are safe and affected users will be compensated. The protocol expects operations to resume as early as Monday and plans to publish a full report after finalizing its restart process.