Gala Games hack — May 2024

On 20 May 2024 an attacker with access to a privileged minter account on the GALA ERC-20 token contract minted 5 billion new GALA. At prevailing prices the newly minted supply was widely reported as notionally worth over $200 million. The account carried the contract's minting role and, according to Halborn, had not been used for roughly six months before it was compromised.

The attacker sold roughly 600 million of the minted tokens on Uniswap, receiving 5,913 ETH, worth approximately $22.2 million at the time. Gala Games said it detected the compromise and removed unauthorised access within 45 minutes, then used a blocklist function added to the contract a year earlier to freeze the attacker's address, stranding the remaining roughly 4.4 billion tokens before they could be sold. GALA fell to $0.039, about 19 percent below a high set just over an hour earlier, and recovered to $0.042 after Gala said the incident was contained.

On 21 May the attacker's wallet sent 5,913.2 ETH, about $22.3 million, to an address controlled by Gala. Gala attributed the return to its own response and to the involvement of federal law enforcement, and its chief executive said the team would probably buy and burn GALA with the proceeds. Gala said it was working with the FBI, the U.S. Department of Justice and international authorities and that it had identified the person responsible, but has never named anyone publicly and no charges have been announced. Claims circulating in the community that the account belonged to a security contractor have not been confirmed by the company.

Published loss figures cluster between $22.2 million and $22.3 million depending on whether the ETH is valued when sold or when returned. The $200 million headline is notional: those tokens were frozen and never converted.