pNetwork (pGALA bridge) hack — November 2022

On 3 November 2022 pNetwork disclosed that the pGALA contract on BNB Chain, the wrapped representation of Gala Games' GALA token issued through its bridge, had been deployed with a misconfiguration that left mint authority outside the team's control. pNetwork said in its post-mortem that ownership of the contract had been covertly taken over, meaning an unknown party could mint uncollateralised pGALA and use it to claim the GALA collateral held on Ethereum.

Rather than wait, pNetwork used its own privileges to mint 55.6 billion uncollateralised pGALA in two equal batches at 20:13 and 20:27 UTC and sold them into the PancakeSwap pGALA/WBNB pool, extracting 12,977 BNB. pNetwork put that at $4,589,449 at the time; The Block reported roughly $4.3 million and gave the figure as 12,976 BNB. pNetwork described the drain as a white-hat action to stop the pool being taken by someone else, and said no hack had in fact been carried out by whoever controlled the contract.

That characterisation is disputed. HTX published a statement calling the operation a malicious hack driven by profit and bad faith rather than a white-hat operation, said pNetwork minted the tokens 50 minutes after contacting exchanges, and argued that a minimum of 24 hours' notice was warranted. Gala Games sued pNetwork on 20 March 2023, seeking approximately $27.67 million, alleging that pNetwork was negligent in maintaining the bridge and mistakenly leaked a governance key when deploying it, and that pNetwork's recovery plan failed to recover the assets and caused further harm.

pNetwork's published plan was to reissue fully collateralised pGALA one-for-one against snapshot balances and to return the 12,977 BNB to holders of the uncollateralised token. Its post-mortem records that the redistribution scheduled for 11 November 2022 was postponed for legal and compliance reasons. Whether the distribution was ultimately completed in full is not established by the sources here, and Gala's suit alleges that it was not.