Payy Airdrop 2026: Network Halted After $1.83M Exploit

Payy Airdrop 2026: Network Halted After $1.83M Exploit

If you were farming Payy's zk-Points, stop and read this first: the network you were farming is not running.

As of October 2026, Payy Network is halted. On September 24, 2026 at 4:21 UTC, Payy's Ethereum bridge contract was exploited and drained. One transaction moved about 1,832,149 USDC, and some reports put the total near $1.92 million. Payy paused deposits, withdrawals, transfers and card payments. L2BEAT lists the network as halted, notes no state updates since September 24, and warns users not to deposit (L2BEAT).

My take: an airdrop is worth nothing if the vault it sits on is empty. Protect the principal first.

What is Payy?

Payy is a privacy-focused stablecoin payments app and Ethereum rollup, formerly Polybase, that shields transfers with zero-knowledge proofs. It offered a non-custodial wallet (from January 2024), money sent by sharing a Payy link with no gas or fees, and a Visa card for spending USDC (launched August 2025). Deposits came from Ethereum, Base, Polygon, Optimism and Arbitrum. In February 2026 it moved its rollup from Polygon to Ethereum. It reported more than 100,000 users in 120 countries.

Funding: a $6M seed led by FirstMark Capital with Robot Ventures and DBA Crypto (closed December 2025, announced March 2026), structured as a SAFE with token warrants, for $8M raised in total.

Is the Payy airdrop still happening?

Payy has not confirmed a token or airdrop, and its network is halted as of October 2026. The SAFE with token warrants meant a native token was planned, but no timeline was ever set. zk-Points (earned by holding a balance, referrals, and 10,000 for activating the Visa card) cannot be earned in any meaningful way while transfers and deposits are paused. Treat any Payy airdrop as on hold at best.

What happened in the Payy exploit?

Payy's bridge contract was drained on September 24, 2026 through its rollup verification path, according to on-chain analysis cited in coverage. The stolen USDC was reportedly swapped to about 683 ETH and spread across wallets, part of it through Railgun. Payy's initial review reportedly ruled out a compromised key and off-chain infrastructure. L2BEAT also records an earlier critical circuit vulnerability, disclosed June 10, 2026, that the team patched.

What should I do if I had money in Payy?

Payy at a glance

• Status: network halted since September 24, 2026; do not deposit
• Exploit: about 1.83M USDC drained from the Ethereum bridge (some reports ~$1.92M)
• Token: none confirmed; planned via token warrants, no timeline
• Points: zk-Points (balance, referrals, 10,000 for card activation), effectively on hold
• Funding: $6M seed led by FirstMark Capital; $8M total
• Original invite (reference only): Payy

Where to go instead

• Spend crypto without selling: XPlace , a non-custodial card on Solana with an XP program.
• Card plus neobank with a live token: Tria .
• Privacy tech, farmed with effort instead of deposits: Fhenix .
• Not sure what fits you? Ask the planner , or browse the best airdrops this October and the full airdrops catalog .

Build it

The tool that would have helped every Payy user: a bot that watches a rollup's escrow balance and state updates and pings you the moment either breaks pattern. It is a small build with a big audience. Start on Deployr .