Three DeFi protocols lost a combined $11.1 million to separate exploits on Thursday, September 25, 2026, as attackers hit payroll-focused rollup Payy Network, crypto casino Duelbits, and EVM-compatible chain Meter.io within hours of one another. The cluster marks one of the most concentrated single-day loss events in DeFi since 2025, and it arrived in a week when auditors had already flagged a rise in exploit attempts across social channels.

Pseudonymous on-chain investigator Specter first flagged the Payy Network incident in a Telegram message, identifying suspicious withdrawals from the protocol's bridge to Ethereum. The attacker, funded via privacy protocol Railgun, swapped $1.8 million in USDC for ETH and drained the bridge's entire balance.

Payy confirmed the exploit on X and paused all operations, advising users against any further deposits until the firm completes its post-mortem. The team clarified that the drained funds were "users' non-custodial deposits to Payy Network/Payy Wallet." The firm has not yet disclosed the technical cause of the breach.

What does the Duelbits incident reveal about hot-wallet security?

Casino and sports betting operator Duelbits lost approximately $7 million in what observers characterized as a private key compromise. Blockchain security firm PeckShield initially tallied losses at $4.3 million, and Specter later revised the figure upward to $5.9 million after identifying affected addresses on Bitcoin and Solana.

Duelbits co-founder DuelbitsJoe set the final number at roughly $7 million in an X post. The platform lost $4.6 million in a 2024 incident that auditor CertiK also attributed to a private key compromise, making the September 25 breach the second key-management failure at the casino in under two years and raising fresh questions about the operator's custody architecture.

How did the Meter.io bridge fail?

Meter.io suffered a distinct attack vector. Rather than draining existing deposits, the attacker minted $2.3 million in unbacked tokens through a "block validation flaw," according to statements from the Meter.io team and on-chain analytics firm Blockaid. The attacker sold the tokens on PancakeSwap, crashing MTR by nearly 80% and MTRG by roughly 75%, per CoinMarketCap.

In an X post, the Meter.io team wrote: "we've preserved the chain state. The recovery method is still to be decided." Meter lost $4.4 million in a 2022 bridge exploit, marking its third cross-chain-related incident in four years and the second time a validator-related bug has produced token inflation.

What operational gaps does the cluster expose?

All three attacks targeted either bridge contracts or hot-wallet credentials, the two vulnerability classes that produced the largest single-day losses in DeFi throughout 2025 and 2026. None of the three teams has named a suspect, and only Payy and Meter have committed to public remediation timelines.

For Meter, recovery options now center on a community-approved chain restart or token migration, a process that typically spans several weeks and leaves holders exposed to secondary price dislocation and reduced liquidity on decentralized exchanges. Until the three protocols publish full post-mortems, the cluster will continue to pressure insurance pricing and bridge audit demand across the sector.