The cross-chain protocol Chainflip has released details about the hack. The attacker withdrew 736,442 USDT in six unauthorized transactions; the remaining funds were not affected, and victims will be compensated for their losses.
In Tron, the protocol reads swap instructions from the transaction memo rather than through a smart contract, as is done in other networks. The attacker attached their memo to a transaction already signed by validators; the system interpreted this memo as a separate failed swap and returned the funds, resulting in one deposit being paid twice. Over the course of an hour and a half, the scheme was executed eight times, gradually increasing the amounts involved.
The network has been temporarily suspended pending the completion of the fix. Chainflip noted that this is the first instance of funds being lost from their vaults and attributed the rise in such attacks across the industry to the development of AI models.