Payy, a DeFi payments network, halted deposits, withdrawals, and card payments after an attacker drained $1.92 million in USDC, with proceeds converted to approximately 683 ETH and distributed across three wallets. The protocol has not disclosed the exploit vector, and the network remains paused pending a post-mortem and potential remediation.
Though the dollar amount is modest, the incident is operationally instructive for Armada's crypto desk: USDC held in smart contract-based protocols carries exploit risk that differs fundamentally from Fireblocks-custodied assets. Armada's no-rehypothecation policy and Fireblocks custody model insulate client collateral from this vector, which is a key differentiator to reinforce with family office and institutional counterparties evaluating on-chain repo infrastructure.