GANA Payment hack — November 2025

On 20 November 2025, at around 05:00 UTC and roughly nine days after the platform launched, more than $3.1 million was drained from GANA Payment, a BNB Chain payment-token project with a staking contract. The attacker obtained owner-level control of the staking contract. Halborn's analysis attributes this to a takeover of the contract, most likely through theft of the private keys used to transfer ownership, rather than a flaw in the contract's public logic. Holding owner privileges, the attacker manipulated the contract's reward rates and then exploited the unstake function to withdraw far more GANA than had been staked, converting the tokens into BNB and ETH. Proceeds were laundered quickly, though the published traces do not fully reconcile. Cryptopolitan, drawing on on-chain tracking credited to ZachXBT, HashDit and OnChain Lens, reported 1,140 BNB, about $1.04 million, deposited into Tornado Cash on BNB Chain, and — after the remaining assets were bridged to Ethereum — a further 346 ETH, about $1.05 million, deposited into the mixer, naming as the Ethereum laundering address. The Crypto Times reports the same 1,140 BNB deposit but puts the Ethereum leg at 346.8 ETH and separately describes 346 ETH, about $1.046 million, as still untouched at that same address. The two accounts appear to describe the same tranche in different states rather than two separate tranches, and no source reconciles them. The Crypto Times gives the attacker's consolidation address; Cryptopolitan lists BSC theft addresses 0x2e8a…aae5c38 and 0xd10e…cc8fa4d. Later movements were split into 1, 10 and 100 ETH batches. GANA Payment confirmed the theft, saying its "interaction contract has been targeted by an external attack, resulting in unauthorized asset theft", and that it would investigate with internal engineers and outside security firms. Halborn reports the project subsequently announced a reboot that would remap users' asset addresses and associated permissions. The GANA token fell more than 90 percent. Published loss estimates cluster at "over $3.1 million", so that figure is a floor rather than a reconciled total. No party has released a final figure and GANA has not itself stated an amount.