GalaChain exploit on 2026-08-18
Exploit, 18 Aug 2026. Last verified 4 Nov 2026.
major
Reported loss
Not in USD
see the amount as stated below
Recovered
-
nothing reported
Status
Ongoing
updated 26 Oct 2026
Date
other
Summary
On 2026-08-18 an automated attacker abused a signature-verification flaw on GalaChain to make unauthorized transfers from nine wallets, moving approximately 2.0 billion GALA and roughly 37 other tokens and bridging the proceeds out. Gala paused the bridge and deployed a fix the same morning; its investigation is ongoing.
- Protocol
- GalaChain
- Type
- Exploit
- Reported loss
- approximately 2.0 billion GALA and roughly 37 other tokens
Facts and where they come from
| Fact | Value | Source |
|---|---|---|
| Date | 18 August 2026 | news.gala.com ↗ |
| Amount | approximately 2.0 billion GALA and roughly 37 other tokens | news.gala.com ↗ |
| Largest single loss | 1,639,810,337.11548495 GALA | news.gala.com ↗ |
| Response | bridge paused, permanent fix deployed at 06:27 UTC | news.gala.com ↗ |
| Status | investigation ongoing | news.gala.com ↗ |
Primary sources
- Gala: GalaChain security incident technical post-mortem ↗ post-mortem · accessed 2026-11-04
Our own summary of facts published by the sources above. We do not attribute fault beyond them. Amounts are as the sources state them (no USD conversion by us); links and quoted figures last checked 2026-11-04.
Get the next one first
- Alert on new security incidents: hacks, depegs, TVL drops and exchange outflows, by e-mail or Telegram