Chainflip Plans Zero-Balance Migration for TRON USDT Providers After $736K Exploit

Chainflip plans to reset the active TRON USDT balances of affected liquidity providers to zero as part of a restart and recovery process following the exploitation of 736,442.17 USDT disclosed on Sept. 12.

Before the reset, the protocol will record each provider’s balance immediately before migration in a separate on-chain ledger. That record will preserve the amount Chainflip says it owes, while the provider’s live account will show zero. Repayment has not yet been completed.

As of Sept. 16, Chainflip said swaps and quoting had resumed throughout the rest of its network, with TRON still suspended. The phased restart leaves affected route providers waiting for the balance migration and a separate recovery process.

Chainflip said an attacker drained USDT from its TRON vault between 01:44 and 03:10 UTC on Sept. 12 by arranging for six liquidity-provider withdrawals to be paid twice.

The exploit took advantage of the way the protocol interpreted instructions embedded in TRON transfers. According to Chainflip, the attacker submitted a transaction that validators had already signed and appended a malformed memo. Software monitoring the transfer read that memo as a failed swap and issued a refund in addition to the legitimate withdrawal.

The protocol now says the TRON vault holds substantially less USDT than provider balances require. The restart plan therefore distinguishes the vault’s live balance from the amount that must ultimately be recovered and repaid.

How Chainflip will track the shortfall

Chainflip’s migration plan will close open TRON/USDT orders and strategies and unwind associated loans and lending positions. The protocol and its software release refer to USDT on TRON as “trxUSDT.”

Each provider’s pre-migration trxUSDT balance will be recorded in a separate on-chain position before the active balance is reset to zero. Chainflip says this ledger entry will preserve the amount available for future repayment.

These recorded balances are not the same as completed reimbursements. After migration, providers’ live trxUSDT accounts will display zero until funds are repaid.

Chainflip has committed to restoring affected providers to their original positions. However, its public updates have not identified a funding source or repayment timetable, confirmed any payments, or provided a definitive figure for the amount recovered.

The protocol said it fixed the vulnerability by restricting which TRON transfers may include swap instructions in a memo. The updated rules recognize memos attached to plain TRX transfers and direct TRC-20 token transfers, while excluding transfers nested within another contract call—the path used to trigger the unauthorized refund.

Chainflip said the remaining funds were unaffected. The disclosed shortfall, position unwind, and balance reset apply only to trxUSDT liquidity providers.

Source link