Gala Games

Private Key Leakage

Estimated loss

$21.80M

VERDICT —OUT OF SCOPE

Root cause is private-key / signer compromise — the on-chain contract behaved exactly as written. No pre-deployment source audit or bytecode review reaches the key-custody perimeter; this is operational-security territory (HSM/MPC hygiene, key rotation, hot-wallet isolation). Bytecode would show nothing wrong.

▰ METHOD

PRIVATE KEY

PRIVATE-KEY

Root cause

Root-cause analysis not yet published. The incident description below contains all currently available signal — review the attack transaction directly for definitive forensics.

Forensic narrative

On May 20, 2024, the Web3 gaming platform Gala Games was attacked, resulting in a loss of approximately $21.8 million. The attacker minted 5 billion GALA tokens, worth over $200 million, and quickly sold 592 million GALA, receiving 5,952 ETH. On May 22, according to on-chain records and a statement from Gala Games on Discord, the digital wallet associated with the Gala Games hacker transferred 5,913.2 ETH, which was the hacker returning the stolen funds. Attack method (per SlowMist): Private Key Leakage. Reported loss: $ 21,800,000.

Primary source

https://x.com/Benefactor0101/status/1792698768166715776 ↗

Sourced from

slowmist

Technical record