News
Gala Games Attacker Returns Ethereum After $240 Million Token Exploit
Behind him is the yet unidentified attacker Monday’s $240 million Gala Games token exploit returned the Ethereum (ETH) gained from the sale of some tokens, as Gala deals with the consequences of the attack and how to address the remaining questions.
It was around 5,913 ETH, or around $22 million sent back from the attacker’s wallet to a Gala wallet Tuesday morning, representing funds earned from the sale of 600 million GALA tokens on a decentralized exchange Uniswap shortly after Monday’s exploit.
In Gala’s Discord server on Tuesday, CEO Eric “Benefactor” Schiermeyer said the company will “likely buy and burn” GALA tokens using recovered ETH, a move that could potentially drive the token’s price higher after the drop on Monday.
On Monday, Schiermeyer wrote in an announcement on Discord that the cryptocurrency gaming startup believed it knew who was behind the attack and said it was working with authorities to bring the attacker to justice. The person in question has yet to be publicly identified, and Gala Games declined to comment beyond the published statements.
Gala published a blog post recounting the attack and the countermeasures taken by the company on Tuesday. On Monday, a wallet with administrative access to the GALA token minting contract minted 5 billion GALA tokens, or about $240 million at the time of the exploit, and then began selling them on the open market.
After about 45 minutes, Gala was able to stop the wallet from making any further sales thanks to a feature built into last fall’s v2 contract update. The attacker managed to sell 600 million GALA tokens before this happened, and the price of GALA plummeted 20% during that period as the market struggled with the token surge.
“We want to assure our community that $GALA’s minting capabilities on GalaChain remain secure and uncompromised,” the post reads. “Our internal controls and multisig security protocols are designed to protect against such incidents, and we continually improve them to stay ahead of potential threats.”
However, while the company said the contract is secure, Schiermeyer had already written on Monday that Gala had “matched” regarding access to those features.
“We messed up our internal controls…this should not have happened and we are taking steps to ensure it never happens again,” he wrote Monday.
What about the other 4.4 billion GALA tokens? This is almost 9% of the total supply of 50 billion GALA tokens, which are currently frozen in the attacker’s wallet. Schiermeyer wrote on Monday that they would be considered “effectively burned,” since they are inaccessible and cannot be spent.
In other words, the Gala ecosystem would consider them out of circulation. But now it appears that Schiermeyer’s classification was premature and the community of Gala network node operators will have a chance to vote on the issue.
“A new vote on the governance of the Founder’s Node ecosystem will soon decide whether the blacklisted GALA will be considered burned as it relates to GALA’s dynamic supply distribution model as described in the Gala Ecosystem Project“, the post reads.
By Ryan Ozawa.