- Unauthorized withdrawals of 140 million GALA tokens occurred from the GalaChain bridge between October 13 and November 10.
- These tokens, worth about $1.5 million, were withdrawn daily in 5 million GALA increments and exchanged for ETH.
- The withdrawals lacked matching deposit transactions on the GalaChain side, suggesting a one-sided bridge activity.
- Gala Games paused the Ethereum bridge on November 10 and changed control authorities shortly after.
- Gala has not publicly detailed the cause of these withdrawals, and the incident mirrors a previous May 2024 security breach involving 600 million GALA tokens.
Between October 13 and November 10, a series of unauthorized transfers removed 140 million GALA tokens from the GalaChain bridge. These withdrawals, believed to be suspicious, happened almost daily in exact amounts of 5 million GALA and were routed to Ethereum addresses where the tokens were swapped for ETH.
Community members monitoring these activities noticed the absence of corresponding deposit transactions on GalaScan, the transaction explorer for GalaChain. The withdrawal process is supposed to involve tokens being burned or locked on the originating chain, then minted or unlocked on the destination chain, but the GalaScan records showed no such corresponding bridge transactions. This irregularity raised concerns about potential misuse of privileged access.
The withdrawals continued until November 10, when an additional 10 million GALA tokens were withdrawn just hours before Gala paused the Ethereum bridge. Shortly after pausing, Gala executed a transaction to change the bridge’s control authorities. Community representatives alerted Gala via Discord on November 6 but received no explanation beyond stating that GalaScan was still a “work in progress.”
This incident resembles an earlier security breach in May 2024, when 600 million GALA tokens were improperly sold, totaling $21 million. The Gala CEO had then acknowledged internal control failures and pledged improvements. The current pattern of daily unauthorized withdrawals, delayed recognition, and emergency authority changes suggests ongoing vulnerabilities in Gala’s infrastructure.
Public announcements by Gala Games have only referenced “community feedback and concerns” as reasons for pausing the bridges, without explaining the details of the unauthorized withdrawal event. Attempts by Protos to obtain further comments from Gala had not been successful before publication. Additional information, including transaction details, can be found on Etherscan and GalaScan.
For reference, the first suspicious withdrawal on October 13 showed normal GalaScan transaction records for smaller token movements nearby, but the large 5 million GALA minted on Ethereum had no corresponding locking event on GalaChain, highlighting the one-sided nature of the bridge operations.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
