Key Highlights
- GANA Payment was exploited for over $3.1M, first reported by Vlamidir S and actively tracked by investigator ZachXBT.
- Attacker used Tornado Cash on BSC and Ethereum to mix more than $2M in BNB and ETH, obscuring the money trail.
- 346 ETH (~$1.05M) remains idle in a known attacker wallet, while the project team has not yet issued any official statement.
A major exploit has hit GANA Payment, a Binance Smart Chain–based crypto payments project, resulting in more than $3.1 million in losses. The incident came to light when crypto commentator Vlamidir S posted the findings on X, citing details uncovered by well-known blockchain investigator ZachXBT.
Tracking began almost immediately through Zach’s Telegram investigation channel, where suspicious fund movements were flagged shortly after the attack occurred. This incident occurred just nine days after the platform’s launch, highlighting vulnerabilities in newly deployed smart contracts.
What is GANA payment?
GANA Payment is a BSC-based Web3 payment project that basically helps people send crypto quickly and lets merchants accept payments easily. While not a major name in the payments industry, it has an active niche user base within the BSC ecosystem.
How the funds were moved
According to early findings, the attacker consolidated the stolen assets into a primary address: 0x2e8a8670b734e260cedbc6d5a05532264aae5c38
From the main consolidation wallet, the attacker immediately began moving the stolen funds through laundering channels. The first step was sending 1,140 BNB, worth roughly $1.04 million, into Tornado Cash on Binance Smart Chain.
Tornado Cash is often used in such incidents because it mixes deposits in large pools, making it difficult to trace where the funds originally came from.
After masking the trail on the BSC, the attacker shifted part of the loot to the Ethereum network. Once the assets were bridged there, another 346.8 ETH (around $1.05 million) was deposited into Tornado Cash again, repeating the same mixing strategy.
Using mixers across multiple chains is a common tactic among exploiters, as it breaks the transaction path in several places and makes on-chain tracking far more complicated.
Funds still sitting idle
Even after all the mixing, a sizeable portion of the stolen money hasn’t moved at all. Investigators have pointed out that 346 ETH, valued at roughly $1.046 million, is still untouched at the address: 0x7a503e3ab9433ebf13afb4f7f1793c25733b3cca.
Funds sitting idle like this usually suggest the attacker is waiting for the noise to slow down or searching for a new route to move the assets without drawing attention.
What the GANA team has said
In response to the exploit, GANA Payment issued an urgent notice confirming that its interaction contract was compromised, allowing an external attacker to steal assets.
The team stated that both their internal engineers and an independent security firm are now conducting an emergency investigation to understand how the breach occurred, identify weaknesses, and measure the full extent of the damage.
GANA said it will keep users updated through official channels as the investigation progresses.
To move forward, GANA says it is preparing a full reboot of the project. Part of that process involves compiling a complete list of all user asset addresses and checking the permissions linked to them.
The team added that it will soon share a clear recovery plan with timelines and actionable steps, aiming to protect users and eventually restore all affected assets.
The native $GANA token plummeted over 90% immediately after the news, trading near zero on platforms like GeckoTerminal. Trading volume spiked amid panic selling.
Also Read: Hacker Bypasses Sonic Labs Wallet Freeze, Moves 21M $S Token
