Chainflip Resets Tron LP Balances After $736K USDT Theft

Decentralized cross-chain swap protocol Chainflip has reset the account balances of Tron USDT liquidity providers (LPs) to zero before restarting its network. The previous balances remain recorded on-chain for tracking claim amounts. Chainflip announced in a September 15 blog post that it needed to reset LP balances because the amount owed to LPs exceeded assets stored in the Tron Vault following an attack.

The theft, which occurred on September 12, saw 736,442.17 USDT stolen from the Tron Vault, with attackers receiving duplicate payouts for six LP withdrawals. Chainflip stated in a September 13 incident report that other funds were unaffected. During the restart process, all pending orders and strategies linked to Tron USDT, as well as loan and lending positions, will be terminated. Each LP's pre-reset balance will be recorded on-chain while their displayed Tron USDT balance is set to zero. This on-chain record serves to track amounts owed but does not indicate immediate payment.

Chainflip plans to discuss resolution with affected LPs and compensate losses, though it has not disclosed the recovery amount or payment timeline for stolen funds. The protocol updated its software version 2.2.13 to restrict Tron Vault swaps to direct transfers only, recognizing memo fields in TRX or TRC-20 transactions as swap instructions while blocking other methods.

The attack exploited a vulnerability where attackers altered memos on internally signed transactions that validators had already approved, causing the monitoring layer to treat them as failed swaps and trigger refunds. This resulted in duplicate payouts for legitimate LP withdrawals and refunds. Chainflip's version 2.2.13 now limits this path to direct transfers, making it harder for smart contract wallets or aggregated transactions to access Tron Vault swaps.

Chainflip confirmed no other integrated services use this method. After the network restarts, non-Tron chains will return to their previous state while the Tron route remains suspended until monitoring layer processing catches up. Unpaid user swaps totaling 115,654.41 USDT remain in the Vault and will be paid out after the restart.

LPs are participants providing liquidity to the protocol, while Vaults are on-chain accounts storing swap assets and processing transactions. This measure separates vault asset shortages from LP claims for record-keeping purposes. Chainflip classified this incident as its first major security breach leading to Vault fund loss, noting in the incident report that other funds were unaffected.