The New York Department of Financial Services (NYDFS) confirmed today that Paxos, the issuer of PayPal USD (PYUSD), accidentally minted $300 trillion worth of unbacked stablecoins on October 15, 2025. The regulator added that it is in contact with both Paxos and PayPal regarding the incident.
The event, which momentarily expanded PYUSD’s supply beyond the size of the entire global economy, has triggered fresh scrutiny of the operational and systemic risks underpinning the stablecoin sector.
According to on-chain data, the incident began as a routine transfer of $300 million between Paxos-controlled wallets.
The Information reports that the NYDFS highlighted the matter, citing a fat-finger incident more concerning than Citigroup’s mistake last year. As it happened, Citigroup’s mistake saw the investment banking company mistakenly credit a client with $81 trillion before reversing the transaction.
A former Salesforce engineer, Sam Ramirez, explained Paxos’ move to undo their mistake. They tried to remint the 300 million they burned back into the original wallet. However, they messed up again and accidentally minted 300 trillion.
Within an hour, Paxos burned the excess supply, restored all balances, and confirmed that no customer funds were affected. The company also stated that no external breach occurred.
However, the sheer scale of the minting error has renewed concerns about the reliability of collateralization mechanisms. It also raises questions about manual oversight in stablecoin operations.
Chainlink’s community liaison, Zach Rynes, explained how proof of reserve (PoR) would have prevented this entire FUD.
“…this is a good example of a situation where Chainlink Proof of Reserve would have prevented this entire PR nightmare. Specifically, asset issuers can integrate Chainlink PoR into the minting function of their token contract as a validation check,” Rynes explained.
According to Rynes, the move would have prevented the issuance of additional tokens unless Chainlink PoR had first validated that there is a sufficient amount of off-chain reserves available to maintain 100% collateralization.
Ultimately, it would have prevented infinite mint attacks, where many unbacked tokens are minted, putting at risk all the markets that list and support the token.
Rynes’ remarks ignited industry debate over whether real-time proof-of-reserves validation should become mandatory for all regulated stablecoins.
Financial blog Zero Hedge quickly asked the question that many were thinking. Others also highlight the potential for deliberate misuse.
“…what exactly was this $300 trillion in ‘stablecoin’ collateralized by when it was minted, mistakenly or otherwise,” the popular account on X posed.
These concerns reflect the hypothetical risk that operator access, if abused, could distort markets even for short periods.
In the same tone, other DeFi researchers raised concerns about timing, saying that it raised deeper system questions.
“Everyone saw ‘300 trillion PYUSD minted’ and laughed it off as a software error. But timing and pattern matter. This happened within days of PayPal’s liquidity partnership (Spark, $1 B injection) and the public realignment of PYUSD with tokenized Treasuries… The ‘bug’ was the moment the refinery came online. PayPal will re-rate to $100 ASAP,” wrote 941.
The remark reflected a growing belief that the Paxos event may have coincided with liquidity rail transitions linking traditional finance and tokenized Treasury instruments.
Data firm Santiment reported that the event “caused significant attention as it represents an enormous and unusual amount of stablecoins being created and then quickly burned.
The stablecoin market cap approaches $310 billion. With it, the Paxos overmint is a dramatic reminder that even regulated issuers remain vulnerable to human error and weak process controls.
For regulators, the event could accelerate moves toward mandatory PoR integration, real-time issuance checks, and transparent auditing standards.
If one misplaced zero can mint $300 trillion, the stablecoin industry’s greatest risk may no longer be hackers, but its own operators.
