$3.1 Million Vanishes: The GANA Payment Attack No One Saw Coming

GANA Payment, a project on BNB Smart Chain, lost more than $3.1 million after an attacker gained control of key contract rights, reports have disclosed.

The thief moved much of the haul through Tornado Cash on both BSC and Ethereum, while roughly $1 million remains idle on Ethereum addresses.

How The Attack Unfolded

According to posts by blockchain researcher ZachXBT, the exploiter consolidated stolen assets at address 0x2e8***5c38 before sending 1,140 BNB — about $1.04 million — into Tornado Cash on BSC.

The thief then bridged funds to Ethereum and pushed 346.8 ETH valued at approximately $1.05 million through the same mixer.

About 346 ETH, close to $1.05 million at the time, sits untouched at address 0x7a503***b3cca. Based on reports from security firm HashDit, the breach began when ownership of a GANA contract was changed without permission, giving the attacker admin-level control over staking logic.

HashDit’s analysis shows that whoever took control could call unstake routines and force the system to release far more GANA tokens than it should have.

Those excess tokens were quickly sold off for more liquid assets and then routed into privacy tools. This is a familiar script: manipulate permissions, mint or extract tokens, convert into stable or liquid crypto, then launder.

Who Spotted It And What Happened Next

ZachXBT flagged the suspicious moves on his Telegram channel. HashDit then dug into the contract and identified the altered ownership as the trigger.

GANA’s team posted an emergency notice acknowledging unauthorized activity on their interaction contract and said they brought in an outside security firm to investigate.

The project said it will map user addresses and permissions as part of a planned reboot and will publish recovery steps and timelines through official channels.

Featured image from Pexels, chart from TradingView