On September 23, three separate protocols lost funds in under twenty-four hours. Payy Network's bridge was emptied. Duelbits lost $7 million. Meter.io had $2.3 million in unbacked tokens minted out of thin air.
Total: $11 million.
That number will not move markets. It won't make the front page. And that is exactly the problem.
For weeks now, there has barely been a single day without a security incident in this industry. We have normalized it. We read the headline, we note the dollar figure, we scroll past. The weekly bridge attack has become as routine as a gas fee spike.
But routine does not mean harmless. When we stop paying attention to $11 million days, we lose our ability to see the pattern underneath them. And this particular day carried three patterns worth more than the money.
Security firms PeckShield, CertiK, and the solo investigator Specter were all tracking the fallout before most outlets even opened their keyboards. That is the speed the new normal demands.
Let me set up what actually happened, because the mechanics matter.
Payy Network runs a rollup with a cross-chain bridge. It's a small operation focused on on-chain payroll and treasury management - B2B users, teams moving stablecoins across chains. Specter flagged suspicious withdrawals first. Payy later confirmed the bridge had been completely drained. $1.8 million. Gone. No cause disclosed.
Duelbits is a crypto casino and sportsbook. On the same day it lost $7 million from its hot wallets. The likely cause: private key compromise. This is not Duelbits' first rodeo. In 2024, it lost $4.6 million in a near-identical incident. Co-founder Joe went public fast - confirmed the loss, promised a return, teased Duelbits 2.0.
Meter.io is an EVM chain. Its problem is the most technically serious of the three. An attacker exploited a block validation flaw to mint unbacked MTR and MTRG tokens - $2.3 million worth, created from nothing. MTR fell 80%. MTRG fell 75%. Meter has been here before too. In 2022, a bridge attack cost it $4.4 million.
Three protocols. Three completely different attack mechanisms. Bridge contract, key management, consensus validation.
Here's the first thing worth understanding, and it's why I keep telling readers not to lump crypto hacks into a single bucket.
These three exploits live on three different floors of the stack. Payy was an application-layer failure - the bridge logic or its validator signatures were breached, and there was no circuit breaker to stop the drain once it started. Duelbits was an operations failure - someone's keys got out, which is a human and process problem, not a code problem. Meter was a consensus-layer failure - the ledger itself accepted invalid state, which is the deepest and most dangerous category.
If you're a reader trying to assess your own risk, this matters. A bridge with a clean audit can still be drained by a validator with too much signing power. A chain with perfect consensus can still bleed out because a founder reused a password. Knowing which floor your assets sit on tells you which questions to ask.
To understand why the Meter case is the scariest of the three, you have to understand what unbacked minting actually means. A blockchain's entire value proposition rests on one guarantee: every token in circulation is backed by the consensus rules that created it. When an attacker breaks validation logic, that guarantee evaporates. Suddenly the supply number in your wallet is a fiction. The market understood this instantly - MTR dropped 80% within hours. That is not a price reaction. That is a verdict.
Notice too what none of the three teams did. Not one had a live circuit breaker that froze funds the moment withdrawals went anomalous. Not one had a monitoring layer that could distinguish a normal bridge withdrawal from a drain. All three hit pause after the money left. Pausing after the loss is not defense. It is an obituary.
Now the second thing. The attackers ran a professional pipeline, and it worked end to end.
Funds entered through Railgun, the Ethereum privacy protocol. They got converted into USDC and ETH - the two most liquid, strongest-to-launder assets in the market. When the attacker needed an exit, PancakeSwap served as the sell-off venue. Then the money moved out through bridges.
That is not a script kiddie with a flash loan. That is a repeatable industrial process: privacy in, mint or drain, liquidate on a DEX, bridge out. Every leg of it relies on legitimate infrastructure doing exactly what it was built to do.
I spent years auditing wallet distributions during the 2017 EOS rush, and the lesson from that period holds here. The attacker's edge is rarely a zero-day. It's the fact that legitimate tools don't ask questions. Railgun cannot tell a privacy advocate from a thief. PancakeSwap cannot tell a trader from a money launderer. That is a design feature, not a bug - which is precisely why it gets abused.
The DEX leg deserves its own scrutiny. PancakeSwap processed the sell-off without a hitch. No pause, no suspicious-transaction flag. That's the design - permissionless liquidity doesn't ask where the tokens came from. But it means every major DEX is, functionally, an exit liquidity provider for whoever shows up. The question regulators are now circling is whether the tools that make DeFi trustless also make it complicit.
The third thing is the one that should make you sit up.
Two of the three victims were repeat targets.
Everyone wants to talk about the sophistication of the attackers. I think that misses the story.
Meter lost $4.4 million to a bridge attack in 2022. Years later, it lost $2.3 million to a validation flaw. Duelbits lost $4.6 million in 2024 and $7 million in the same fashion the next year. These are not companies that got unlucky twice. These are companies that did not change.
When a project suffers its first breach, you extend charity. Nobody bats a thousand. The second breach is different. The second breach is a governance failure dressed up as a technical one. It tells you that the cold-hot wallet separation never got fixed, that the multisig threshold never got raised, that the security review never actually shipped.
Here's the part the industry won't say out loud: a security budget is a governance decision, and most token holders have no way to audit it. You can see a project's TVL. You can see its audit reports, if they publish them. You cannot see whether the team actually enforced hardware security modules, whether keys are split across signers who don't share an office, whether anyone on the engineering team has the authority to hit pause.
So we do the only thing the market knows how to do. We wait for the second hack and then we pretend we saw it coming.
The uncomfortable truth is that the industry rewards this. A project that spends its treasury on audits and monitoring looks exactly like a project that spends it on marketing. Both ship a token. Both post a roadmap. The difference only shows up on the day the attacker arrives - and by then, the token holders who funded the theater are the ones holding the bag.
I watched something similar during the Terra collapse in 2022. Users didn't need complex models to know something was wrong. They needed someone to aggregate the truth and say it plainly. The pattern was always visible. The failure was in the telling.
The $11 million is noise. The signal is the shape of the losses.
Two of three protocols were repeat victims, which means this industry's security record is less a technology problem than a follow-through problem. Nobody fixed what the last breach exposed. Everyone moved on to the next headline.
The next headline is already here. The same week, Across, Allbridge, and TeleSwap lost $5.7 million combined. Fetch.ai, NuNet, and SingularityNET lost another $2 million. Bridge after bridge after bridge.
So watch two things in the coming weeks. Whether Meter rolls back its chain - a move that would put its decentralized narrative in direct tension with its survival instinct. And whether Duelbits users can actually withdraw after 2.0 goes live. A casino that can't pay out isn't a victim. It's a counterparty.
Repeats are the only metric that doesn't lie. Price can be manufactured. TVL can be rented. Audit badges can be bought. But a second breach means someone, somewhere, decided the first one wasn't worth fixing.
We keep count of the dollars. We should start counting the repeats.