GANA Payment Suffers $3.1M Exploit on BNB Smart Chain

GANA Payment, a project operating on the BNB Smart Chain, recently suffered a significant security breach, resulting in the loss of over $3.1 million. The attack, identified by blockchain researcher ZachXBT and analyzed by security firm HashDit, stemmed from an attacker gaining unauthorized control over key contract rights, specifically by altering the ownership of a GANA contract. This granted the perpetrator admin-level access to the staking logic, bypassing normal permissions.

The exploiter leveraged this control to force the system to release an excessive amount of GANA tokens, which were then quickly sold off for more liquid assets. The stolen funds, including 1,140 BNB (approximately $1.04 million) and 346.8 ETH (around $1.05 million), were subsequently routed through the privacy mixer Tornado Cash on both BNB Smart Chain and Ethereum to obscure their origin. While a significant portion was laundered, roughly $1 million in ETH remains untouched at a specific Ethereum address (0x7a503***b3cca).

This incident highlights the critical risks associated with smart contract vulnerabilities, particularly regarding contract ownership and administrative privileges in decentralized finance (DeFi) projects. The article does not detail any specific benefits of the GANA Payment platform, focusing entirely on the security compromise. In response to the attack, the GANA team issued an urgent announcement, confirming the unauthorized asset theft and initiating an emergency investigation with an independent security firm. They plan a project reboot, mapping user addresses and permissions, and will publish recovery steps, emphasizing the need for users to avoid trading GANA tokens until further notice.

(Source: https://bitcoinist.com/3-1-million-vanishes-the-gana-payment-attack-no-one-saw-coming/)