How much was stolen in total?

Roughly $11.1M across the three projects, per CryptoNews: $1.8M from Payy Network, $7M from Duelbits and $2.3M in unbacked tokens on Meter.

Was this a coordinated attack?

There is no public evidence linking the three incidents to a single actor. The attack surfaces differ, which points to separate exploits happening to cluster in the same 24-hour window rather than a coordinated campaign.

Has Meter been hacked before?

Yes. Meter's bridge was exploited in February 2022 for about $4.4M in a similar unbacked-mint scenario.

Will affected users be refunded?

None of the three teams had committed to a specific reimbursement plan at the time of the CryptoNews report. Duelbits, as a centralized operator, is the most likely to make users whole from its own treasury.

Payy, Duelbits and Meter Hit in Same-Day Attacks, Losses Top $11M

Three crypto projects were breached on September 24, with attackers draining roughly $11.1M across Payy Network, Duelbits and the Meter bridge, according to a report published by CryptoNews on Saturday. The incidents hit three distinct layers of crypto infrastructure inside a single trading day, a clustering that industry trackers have flagged as unusual even by 2026 standards.

By Elena Stojanović· AI-assisted· Regulation correspondent

What happened

Attackers hit Payy Network, Duelbits and Meter within the same 24-hour window on September 24, per CryptoNews, which first aggregated the three incidents on Saturday. Payy Network, a privacy-focused payments protocol, lost about $1. 8M after an exploit against its wallet infrastructure.

Duelbits, a crypto-native online casino, was drained of roughly $7M in what the report describes as the largest single loss of the trio. The Meter network, a cross-chain bridge and DeFi protocol, saw an attacker mint about $2. 3M in unbacked tokens, inflating supply without any collateral backing.

None of the three teams had published a full technical post-mortem at the time CryptoNews compiled the report. The combined haul, roughly $11. 1M, moved through three distinct attack surfaces: a wallet layer, an application layer and a bridge mint function.

Why it matters

Three separate exploits in one day, hitting three different parts of the stack, is the tell here. It's not one bug class or one shared dependency. Payy's loss points at wallet or key management.

Duelbits is an app-layer breach against a custodial gambling platform. Meter's unbacked mint is the oldest and most dangerous category in DeFi, a bridge that trusted an input it shouldn't have. The Meter incident carries extra weight.

The same protocol was exploited in February 2022 for roughly $4. 4M in a nearly identical unbacked-mint scenario, per prior reporting from The Block at the time. A repeat of the same failure mode, four years on, is the kind of detail that shapes how counterparties price bridge risk into year-end.

Market impact

Payy, Duelbits and Meter Hit in Same-Day Attacks, Losses Top $11M

What happened

Why it matters

Market impact

What to watch

Disclaimer

Key takeaways

Frequently asked

Sources