Payy Says Stolen Funds Made Mnemonics Necessary for Claims

Payy says all funds held on its blockchain were stolen in the Sept. 24 attack, and that requests for users’ mnemonic phrases are limited to verifying balances for compensation claims.

The privacy-focused stablecoin payment network said its design allows only wallet users to view their balances. Without a mnemonic phrase or private key, Payy cannot independently confirm how much USDC a user held.

Payy said the credentials apply only to its wallet and that the mnemonic phrase has no remaining value beyond identifying the amount of USDC in the affected wallet. The network also said it cannot rely solely on zero-knowledge proofs submitted by users because the Aztec ZK framework has known and potential vulnerabilities.

The claim process requires identity information to reduce fraudulent submissions, Payy said. About $1.92 million in USDC was stolen from Payy’s Ethereum rollup during the attack, prompting the network to suspend deposits, transfers and card payments.