Gala Games Confirms $240 Million Worth of Tokens Swiped via Exploit

Ultimately, the attacker managed to sell 600 million of the tokens via decentralized exchange Uniswap, or about $29 million worth at the time of the exploit. The price dropped 20% in less than an hour amid the selling, plunging from about $0.048 to $0.038.

“A compromised or rogue Gala Games admin address minted 5 Billion $GALA ($200M) and has been systematically selling the tokens for the past 2 hours,” pseudonymous smart contract developer and security auditor 0xQuit wrote on Twitter.

Nearly two hours after the hack was spotted, Gala CEO Eric “Benefactor” Schiermeyer posted an update to the Gala Discord server confirming the exploit and explaining the situation.

“We identified the compromise and within 45 minutes we secured and removed unauthorized access to the GALA contract,” Schiermeyer wrote. “It’s important to note our ETH contract for $GALA is secure and under the protection of a multi-sig wallet. It was never compromised.”

The same message was posted to the Gala Games Twitter account. Later, Gala said that the wallet in question had been “frozen.” As a result, the remaining 4.4 billion tokens that weren’t sold are described in the initial post as being “effectively burned,” meaning they can’t be transferred or accessed and thus are considered destroyed. The total supply of GALA encompasses 50 billion tokens.

“We messed up our internal controls… this shouldn’t have happened and we are taking steps to ensure it doesn’t ever again,” Schiermeyer added. “We believe we have identified the culprit and we are currently working with the FBI, DOJ, and a network of international authorities.”

In a follow-up tweet, Gala Games described the attack as an “isolated incident.” Gala did not immediately respond to Decrypt’s request for comment.

GALA has rebounded to a price of about $0.04272 as of this writing, putting the token’s price essentially flat over the past 24 hours. That’s due in part to a market-wide surge that has seen Ethereum itself surge by 20% over the past day, with the residual effects of the market swing apparently offsetting the impact of the sales.

In 2023, Schiermeyer sued fellow Gala co-founder Wright Thurston, alleging that the latter stole $130 million in GALA tokens.

According to the lawsuit, GALA tokens were moved from a company wallet and spread across 43 wallets under Thurston’s control before being sold between September 2022 and May 2023.

In a countersuit, Thurston alleges Schiermeyer neglected to seek his input while making transactions that led to the “sell off and waste [of] millions of dollars in company assets.”

Edited by Andrew Hayward