Payy has completed the first stage of its investigation into a security exploit, the privacy-focused card issuer said in a post on September 25. The team stated it finished initial root-cause analysis and is now working with a third-party audit firm to validate the findings before publishing a full report, which it expects to release "in the next few days."
The most concrete detail in the update is what Payy ruled out. The exploit was not the result of a compromised private key, was not social engineering, and did not stem from a breach of the company's off-chain infrastructure. That narrows the likely surface toward the onchain and cryptographic layer of the system rather than a stolen credential or a phished employee.
Three failure modes ruled out
Each excluded cause matters for how users read the risk. A compromised key would point to custody or signing weakness. Social engineering would implicate staff or support processes. An off-chain infrastructure breach would suggest servers, APIs, or databases were the entry point. By taking all three off the table, Payy is signaling the problem sits deeper in its protocol logic, the part of the stack that a self-custody, spend-from-your-own-wallet product leans on most heavily.
Payy has not yet disclosed the scope of the exploit, the amount involved, or whether user balances were affected. Those figures are the kind of detail a validated third-party report is meant to establish, so the company is holding them until the audit firm signs off. Readers should treat the current update as a status note, not a full incident post-mortem.
Self-custody design raises the stakes on the pending report
Payy positions itself as a privacy-preserving card built on zero-knowledge proofs, where users hold their own funds rather than parking them with a custodian. That design removes some counterparty risk, but it also puts the integrity of the onchain contracts and proof system at the center of user safety. When the failure is not a stolen key or a hacked server, the contract and cryptography become the natural focus of an audit.
The disclosure lands during a rough stretch for crypto security. Bitget confirmed a hot-wallet incident the day before, part of a wider run of exchange and wallet breaches this month. For cardholders, the throughline is that self-hosted and custodial models both carry code risk, and a clear, audited disclosure is the signal that separates a handled incident from an unresolved one.
Cardholder options before the audit lands
Payy card users cannot act on numbers that have not been published yet. The practical steps are narrow: watch Payy's official channels for the validated report, avoid acting on secondhand figures circulating before it, and weigh any new deposits against the fact that the root cause is still being confirmed. The company's decision to validate through an outside firm before releasing conclusions is the standard it should be held to, and the report's contents will determine whether this reads as a contained bug or something larger.
Overview
Payy has finished initial root-cause analysis of a security exploit and ruled out compromised keys, social engineering, and an off-chain infrastructure breach, pointing the investigation toward its onchain and cryptographic layer. A validated report from a third-party audit firm is expected within days. Scope, amount, and user impact remain undisclosed until that report is released. Users of the Payy card should hold judgment and follow official channels for the confirmed findings.
