Yala

Security Vulnerability

Estimated loss

$7.64M

VERDICT —UNRATED

Verdict pending. Auto-ingested incidents are reviewed before a public verdict is rendered.

▰ METHOD

ACCESS CONTROL

ACCESS-CONTROLBYTECODE CATCHABLE →AI SCANNABLE →

Root cause

Root-cause analysis not yet published. The incident description below contains all currently available signal — review the attack transaction directly for definitive forensics.

Forensic narrative

On September 14, the stablecoin protocol Yala disclosed that a recent security incident occurred when a hacker abused a temporary deployment key during the setup of an authorized cross-chain bridge. The attacker deployed an unauthorized bridge and extracted 7.64 million USDC (approximately 1,636 ETH). On October 29, the suspect involved in the case was arrested by law enforcement in Bangkok, Thailand, and most of the affected funds have been successfully recovered. Attack method (per SlowMist): Security Vulnerability. Reported loss: $ 7,640,000.

Primary source

https://blog.yala.org/yala-post-mortem-september-14/ ↗

Sourced from

slowmist

Technical record