Woofun AI reports that Gala Games suffered a $3M loss on August 21st due to a fundamental logic flaw in GalaChain, an incident first exposed by Kate Irwin, a former journalist for Decrypt and Blockworks, as documented by Eric for Foresight News.

The current breach stands in stark contrast to the $200 million incident that occurred two years ago, which was caused by the private key leakage of a high-privilege address. During that May 2022 event, hackers minted tokens worth the stolen amount but eventually returned the funds, allowing Gala Games to destroy the extra minted tokens and resolve the crisis.

Unlike the previous security failure, this vulnerability stemmed from basic code logic issues within GalaChain rather than poor key management. The company did not publicly disclose the incident, likely due to the nature of the flaw, while the GALA token price dropped on the day of the attack but rebounded to its pre-attack level as the broader market improved.

The technical root cause was identified in the getPayloadToSign function handling EIP-712 structured signatures. While EIP-712 types fields inform users of signing contents, only those fields participate in the hashing process; GalaChain's implementation allowed callers to submit types with DTOs, meaning fields in the actual data not declared in types were not covered by the signature.

Attackers exploited this by reusing valid signatures from routine operations like Swap, AddLiquidity, or CollectPositionFees on GalaSwap. They inserted undeclared fields such as to, quantity, and tokenInstance into the TransferToken scenario of GalaChainToken, ensuring the original signature hash remained valid and bypassing approval checks to execute unauthorized transfers.

This attack vector operates similarly to a user signing a document for a normal transaction or adding liquidity on the exchange, only for an attacker to append a clause agreeing to transfer all coins to the attacker. Lookonchain detected the exploitation when a new address received cross-chain GALA and KTA tokens, which were subsequently sold for ETH.

Financial tracing revealed that over 1.6 billion stolen GALA tokens originated from an address linked to Eric Schiermeyer, the co-founder and CEO of Gala Games. The total financial impact was assessed at 3 million US dollars, marking a significant but contained loss compared to previous industry breaches.

Despite the severity, neither Gala nor Schiermeyer issued statements on official platforms or social media, declining to hold the hackers accountable or respond to Kate Irwin's requests for comment. The official silence persisted because no external users were affected, limiting the reputational damage to the core team's assets.

Per Woofun AI, the project team implemented a rapid patch by recursively checking if every actual field existed and was declared in the corresponding type before generating or verifying the signature payload. If unsigned fields were found, the transaction was rejected; the fix PR was merged just 14 minutes after its creation on August 18th.

This incident serves as a critical warning that security extends beyond private keys, multisig, and audits to include the consistency of SDKs, gateways, and chaincode interpretation. While such attacks are rare in self-built chains aiming for speed, the DeFi sector must prioritize robust message verification logic over rapid deployment to prevent similar exploitation.