“`html
GANA Payment, a project on BNB Smart Chain, has unfortunately lost over $3.1 million due to a recent attack where an intruder took control of critical contract rights, according to reports.
The rogue actor funneled much of the stolen assets through Tornado Cash on both BSC and Ethereum, leaving about $1 million still unspent in Ethereum addresses.
How The Attack Unfolded
Blockchain researcher ZachXBT shared that the culprit gathered the pilfered assets at address 0x2e8***5c38 before transferring 1,140 BNB — around $1.04 million — to Tornado Cash on the BSC network.
Next, the thief transferred funds to Ethereum, where they converted 346.8 ETH, valued at around $1.05 million, through the same mixer.
According to Zach (@zachxbt), the GANA Payment project suffered over $3.1M in losses on BSC earlier today.
The attacker initially sent 1,140 $BNB ($1.04M) to Tornado Cash on BSC, then bridged the stolen assets to #Ethereum depositing another 346 $ETH ($1.05M) into Tornado.
The… pic.twitter.com/q7DL8Mdpzf
— Onchain Lens (@OnchainLens) November 20, 2025
Currently, around 346 ETH, valued at nearly $1.05 million, remains untouched at address 0x7a503***b3cca. As per reports from security firm HashDit, the breach happened when ownership of a GANA contract was altered without authorization, granting the attacker admin-level control over the staking process.
GANA Urgent Announcement
Our interaction contract has been compromised in an external attack, leading to unauthorized asset theft. Our technical team, alongside an independent third-party security firm, is currently investigating to determine how this occurred,…
— GANA Payment (@GANA_PayFi) November 20, 2025
HashDit’s investigation revealed that the attacker had the ability to call unstake routines and force the system to release more GANA tokens than it should have allotted.
These extra tokens were swiftly sold off for more liquid assets and then funneled into privacy tools. This pattern is all too familiar: manipulate permissions, mint or withdraw tokens, convert into stable or liquid crypto, and then launder.
Who Spotted It And What Happened Next
ZachXBT was the one who raised the alarm about the suspicious activities on his Telegram channel. HashDit then investigated the contract and determined that the altered ownership was the root cause of the issue.
In response, GANA’s team issued an urgent notice acknowledging unauthorized behavior on their interaction contract and reported that they had engaged a third-party security firm for the investigation.
The team plans to trace user addresses and permissions as part of a rebuild and will keep the community updated on recovery steps via official channels.
🚨HashDit Alert🚨
HashDit has detected that @GANA_PayFi has been compromised for roughly $3.1 million $GANA.
Users should not trade with the $GANA token for now and wait for an official announcement from the team!
Funds have been transferred to TC: https://t.co/rtdjnMvYpI
Root cause: Ownership of… pic.twitter.com/XZzuoMmf8D
— HashDit | now with Pro Extension (@HashDit) November 20, 2025
Featured image from Pexels, chart from TradingView
Editorial Process for bitcoinist is centered on delivering thoroughly researched, accurate, and unbiased content. We uphold strict sourcing standards, and each page undergoes diligent review by our team of top technology experts and seasoned editors. This process ensures the integrity, relevance, and value of our content for our readers.
Source link
“`
