MonitoringCryptoSecurity incidentFirst tracked 2026-09-17Last changed 2026-09-17
Current outcome
An attacker harvested 74 signatures from failed GalaChain transactions and used them to drain roughly 2 billion GALA (~$3 million) plus dozens of other tokens from nine wallets, exposing a gap between signature verification and replay protection that had survived multiple security reviews.
Progress timeline
1 material updates- #01
Hacker turned 55 days of failed transactions into a $3 million master key that drained GalaChain wallets
An attacker harvested 74 signatures from failed GalaChain transactions and used them to drain roughly 2 billion GALA (~$3 million) plus dozens of other tokens from nine wallets, exposing a gap between signature verification and replay protection that had survived multiple security reviews.
Source evidence: CryptoSlate