Chainflip Loses $736K in TRON Exploit | Reform UK Donations Face Legal Test | Private Market Makers Take DeFi Flow | Daily Crypto Roundup.
Crypto News Today
September 13, 2026
Kraken Ledger NordVPN Spotify Chainflip says a transaction-memo flaw let an attacker turn single deposits into duplicate payouts and extract 736,442.17 USDT. The protocol is paused, one legitimate customer is waiting and the exact restart process is still being completed.
TopicsTechnology
SPEAKER_1 (0:00)
Welcome back to the Daily Crypto Roundup. One transaction was paid twice, then the trick was repeated until more than $736,000 in tether had left Chainflip. The bridge is paused, one legitimate customer is still waiting, and the flaw came from something as ordinary as a transaction memo. We also have a new legal threat to $97 million of crypto-billionaire political donations. Evidence that private market makers now dominate some decentralized trades, and a Federal Reserve decision that markets may be forcing rather than inflation justifying.
At the time of recording, Bitcoin is around $77,120, down approximately 0.4% over 24 hours. Ethereum is near $2,488 and lower by roughly 2%.
XRP is close to $1.35 after losing about 1.5%.
BNB is around $717.
Solana is near $100.40, and Hyperliquid is close to $78.15.
Cardano is around $0.21, while Chainlink is near $11.28.
Hyperliquid is the weakest move in this group, down approximately 2.8%, although the broad picture is modest losses rather than one exceptional collapse. Tell us whether a bridge should restart before every user has been compensated, and follow Crypto News Today for the mechanism behind the headline. New Kraken users who sign up using our link in the description can claim 20 XRP from Crypto News Today. Availability and eligibility vary by region. The 20 XRP is supplied by Crypto News Today, not Kraken. This is not financial advice. Crypto trading involves risk of loss. The lead story is Chainflip, a cross-chain swapping protocol that has now explained how an attacker extracted 736,442.17 USDT from its Tronvault. Six unauthorized payouts succeeded. One legitimate swap for 115,654.41 USDT remains unpaid, although Chainflip says that customers' funds are still inside the vault and can be released after the system restarts. The exploit did not require breaking Tether, Tron, or the cryptography securing the user's original transfer. Chainflip's Tron integration reads swap instructions from a transaction memo. According to the project's incident update today, an attacker added a separate memo to a transaction that Chainflip validators had already signed. The system interpreted that memo as a failed swap requiring a refund, so one deposit produced two payouts. The attacker repeated the pattern eight times over roughly 90 minutes early Saturday. The first attempts were small, then the amounts approximately doubled.
Chainflip detected the problem after later USDT payouts failed, because the vault no longer held enough money to complete them. A valid blockchain signature proved that validators approved a transaction. It did not prove that attached metadata should trigger another financial action. The accounting logic treated a memo as an independent instruction without binding it tightly enough to the payment already made.
What changed today is the confirmed loss total, the exact double payment mechanism and the status of the unpaid customer.
What did not change is every other asset in Chainflip's vaults. The team says all other funds remain secure and it has not reported a compromise of users' private keys. Chainflip has a fix, but the exact restart procedure was still being completed at recording time. The protocol said it would probably remain paused until Monday at the earliest. It has flagged the receiving addresses, promised compensation and said a fuller report will follow. Its assessment was candid. This sucks, but it's totally recoverable and can be done relatively quickly.
Users benefit from a pause that prevents another payout, but lose access while swaps are stopped. Chainflip's treasury or insurers may absorb the loss if the attacker does not return it. The exploit affected one integration and did not drain every vault. That does not make a restart safe. The recovery claim fails if the USDT cannot be frozen or returned, compensation is incomplete, or the repaired logic permits another duplicate payout. Would you use Chainflip again after the code is patched, or wait for an independent review and the first successful Tron swaps? Watch the published patch, Tether's response to the flagged addresses, the compensation transaction, payment of the pending 115,654.41 USDT swap and the exact time the network resumes.
The second story is a material update to yesterday's record political donations. Christopher Harbourn and BitMEX co-founder Ben Dello each gave 36 million pounds to Reform UK, a combined 72 million pounds, or approximately $97 million.
The payments were reported before today. The new development is that a British minister says proposed legislation may force some or all of the money to be returned. The representation of the People Bill would limit donations from certain British citizens living abroad, or recently returned from abroad, to 100,000 pounds per year.
Its overseas donor provisions are intended to apply retrospectively from March or July, depending on the donor's electoral status.
Official Electoral Commission guidance says that once the law takes effect, a recipient could have 30 days to return donations made after the relevant date that exceed the cap. Community Secretary Angela Rayner said today, we're really clear on that. She said the legislation is moving through parliament. The House of Lords is due to consider the bill this week. The unresolved fact is whether the rules apply to these donors. Both have lived abroad. Public reporting has not established their exact donation dates, legally relevant status, or whether an exception applies. Reform says, all donations to Reform UK comply strictly with electoral commission rules and UK law. No authority has ordered repayment under current law. The crypto connection is the donors, not the payment rail. No verified evidence says either donation is made in cryptocurrency. Reform supports lower capital gains tax and a Bitcoin reserve at the Bank of England. But a donation does not prove those policies were purchased. What changed today is the government's public view that the retrospective rule could reach the money. What did not change is the legality of the donations under current rules, British crypto tax or the Bank of England's reserves. Reform benefits from the cash while it can use it. Rivals benefit if the law removes a historic funding advantage. Donors lose influence only if the money must be returned. The claim that 72 million pounds is secure fails if the bill passes with retrospective language and the donors fall inside its definitions. The claim that it must be repaid fails if their dates or status place the donations outside the rule. Watch the House of Lords amendments, electoral commission filings, the effective date and any formal 30-day return notice. If you want to protect your crypto with a hardware wallet, our Ledger link is in the description. The third story changes how decentralized exchange should sound to an ordinary trader.
4 more minutes of transcript below
Thousands of transcripts fetched by people building searchable podcast archives
Fetch the whole transcript
The demo key returns a sample episode in full, no card needed:
curl -H "x-api-key: pt_demo" \
https://spoken.md/transcripts/1000651996090Markdown with the speakers named, for your notes, your knowledge base, or anything that makes HTTP calls.
From $0.10 per transcript. No subscription. Credits never expire. Prices exclude VAT, added at checkout for EU customers. Not what you expected? Email us within 14 days with 20 or fewer credits used and we refund the pack in full.
Using your own key:
curl -H "x-api-key: YOUR_KEY" \
https://spoken.md/transcripts/1000789364893