Gala Games Hack
What happened
On May 20, 2024, an attacker used a compromised privileged GALA minter key on Ethereum to mint 5 billion GALA tokens. Gala blocklisted the attacker within roughly 45 minutes, limiting the tokens that could be liquidated.
A private key for an Ethereum address holding the GALA minter role was compromised. The token contract itself was not breached: the incident arose from inadequate control of a privileged key, which allowed authorized mint functionality to be abused.
How it happened
The attacker controlled an address with permission to mint GALA and used that legitimate privilege to mint 5 billion tokens. They transferred the tokens to a new wallet and swapped roughly 592 to 600 million GALA for ETH. Gala then blocklisted the exploiter, froze the remaining minted balance, and later burned the unauthorized token supply through a governance-approved process.
The incident's defensible loss measure is the realized proceeds, not the paper value of all 5 billion minted tokens. Gala reported that the ETH proceeds were returned and used for buybacks and burns, but the sources differ slightly on the returned ETH amount, so no precise recovered-USD figure is given here.
Protocol details
Funds Recovery
Recovered
$22.3M
Net Loss
$0
Evidence
- report de.fi Analysis x.com
- report @Thatguysgems incident report x.com
- report Incident Report: Unauthorized Token Minting news.gala.com
- report Gala Games Incident Analysis rekt.news
- transaction Gala Exploit Transaction etherscan.io
- analysis DeFiLlama defillama.com
- analysis Unauthorized Wallet Locked Down and Funds Returned news.gala.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
