Gala Games exploit

On May 20, 2024 an attacker abused a privileged minter account on the GALA token contract to mint 5 billion GALA (≈$200M+ nominal) and dumped ~600M of them for ~$22M of ETH before Gala froze the address. Gala Games called it an internal access-control failure; the attacker later returned the ~$22M.

Also known as: Gala Games, GALA, Gala Games exploit, Gala Games hack

Summary

On May 20, 2024, an attacker gained control of a privileged "minter" account on the GALA token smart contract — a long-dormant account with mint permissions — and minted 5 billion new GALA, worth roughly $200 million+ at prevailing prices. The attacker sold about 600 million tokens on Uniswap, realizing around $22 million in ETH. ^[1]^[2]

Response

Within about 45 minutes Gala Games froze the attacker's address, rendering the remaining ~4.4 billion minted tokens unsellable ("effectively burned"), which limited the market damage. Gala's CEO publicly acknowledged the internal control failure ("we messed up"), and the attacker subsequently returned the ~$22 million of ETH. The incident is best characterized as a privileged-key/access-control compromise rather than a contract logic bug. ^[1]^[2]^[3]

Bracketed numbers refer to the numbered sources listed below.

Sources (3)

'We Messed Up': Gala Games Confirms $240 Million Worth of Tokens Swiped via Exploit — Decrypt
Explained: The Gala Games Hack (May 2024) — Halborn
Gala Games CEO admits fault in $240 million token exploit — Crypto Briefing

Gala Games exploit

Summary

Response

Sources (3)

See also