GANA Payment, a project on BNB Smart Chain<\/a>, has unfortunately lost over $3.1 million due to a recent attack where an intruder took control of critical contract rights, according to reports.<\/p>\n The rogue actor funneled much of the stolen assets through Tornado Cash<\/a> on both BSC and Ethereum<\/a>, leaving about $1 million still unspent in Ethereum addresses.<\/p>\n Blockchain researcher ZachXBT shared that the culprit gathered the pilfered assets at address 0x2e8***5c38 before transferring 1,140 BNB \u2014 around $1.04 million \u2014 to Tornado Cash on the BSC network.<\/p>\n Next, the thief transferred funds to Ethereum, where they converted 346.8 ETH, valued at around $1.05 million, through the same mixer.<\/p>\n According to Zach (@zachxbt<\/a>), the GANA Payment project suffered over $3.1M in losses on BSC earlier today.<\/p>\n The attacker initially sent 1,140 $BNB<\/a> ($1.04M) to Tornado Cash on BSC, then bridged the stolen assets to #Ethereum<\/a> depositing another 346 $ETH<\/a> ($1.05M) into Tornado.<\/p>\n The\u2026 pic.twitter.com\/q7DL8Mdpzf<\/a><\/p>\n \u2014 Onchain Lens (@OnchainLens) November 20, 2025<\/a><\/p>\n<\/blockquote>\n Currently, around 346 ETH, valued at nearly $1.05 million, remains untouched at address 0x7a503***b3cca. As per reports from security firm HashDit, the breach happened when ownership of a GANA<\/a> contract was altered without authorization, granting the attacker admin-level control over the staking process.<\/p>\n GANA Urgent Announcement<\/p>\n Our interaction contract has been compromised in an external attack, leading to unauthorized asset theft. Our technical team, alongside an independent third-party security firm, is currently investigating to determine how this occurred,\u2026<\/p>\n \u2014 GANA Payment (@GANA_PayFi) November 20, 2025<\/a><\/p>\n<\/blockquote>\n HashDit’s investigation revealed that the attacker had the ability to call unstake routines and force the system to release more GANA tokens than it should have allotted.<\/p>\n These extra tokens were swiftly sold off for more liquid assets and then funneled into privacy tools. This pattern is all too familiar: manipulate permissions, mint or withdraw tokens, convert into stable or liquid crypto, and then launder.<\/p>\n ZachXBT was the one who raised the alarm about the suspicious activities on his Telegram channel. HashDit then investigated the contract and determined that the altered ownership was the root cause of the issue.<\/p>\n In response, GANA\u2019s team issued an urgent notice acknowledging unauthorized behavior on their interaction contract and reported that they had engaged a third-party security firm for the investigation.<\/p>\n The team plans to trace user addresses and permissions as part of a rebuild and will keep the community updated on recovery steps via official channels.<\/p>\n \ud83d\udea8HashDit Alert\ud83d\udea8<\/p>\n HashDit has detected that @GANA_PayFi<\/a> has been compromised for roughly $3.1 million $GANA<\/a>.<\/p>\n Users should not trade with the $GANA<\/a> token for now and wait for an official announcement from the team!<\/p>\n Funds have been transferred to TC: https:\/\/t.co\/rtdjnMvYpI<\/a><\/p>\n Root cause: Ownership of\u2026 pic.twitter.com\/XZzuoMmf8D<\/a><\/p>\nHow The Attack Unfolded<\/h2>\n
![\"\"](\"https:\/\/bitcoinist.com\/wp-content\/uploads\/2025\/11\/A_0430d7.png?resize=542%2C853\")
<\/p>\n\n
\n
Who Spotted It And What Happened Next<\/h2>\n
\n
![](\"https:\/\/bitcoinist.com\/wp-content\/uploads\/2025\/02\/safe.png\")
<\/p>\n