Payy Rules Out Compromised Key in $1.92M Drain of User Deposits

The two-batch structure — a small test transfer followed by the bulk roughly five hours later, both to one address — reads more like a prepared exit than an external exploit, which is why the denial of a compromised key carries weight beyond the dollar figure. For a bridge, the distinction matters: if no key was lost, the question shifts to what access path or logic the operator left open. That answer determines whether other bridges with similar designs face the same exposure, and whether users get any recovery path. Watch for independent verification of the access route, not just the denial.