Huobi says pNetwork Hacked Gala in a “premeditated attack” to Make Profits 

Last week, panic and chaos ensued with the news of a potential billion-dollar hack on the play-to-earn (P2E) platform Gala Games.  The incident pushed GALA token prices to fall 20%. Trading under $0.035 at the time of writing, the GALA token is down almost 96% from its all-time high a year back.  

What happened was a single blockchain address minted more than $1 billion worth of GALA tokens out of thin air. The coins were minted on BNB Smart Chain, and a portion of it was dumped on DEX PancakeSwap. In the process, 12,977 BNB, worth around $4.5 million, were earned. This drained the PancakeSwap pool and caused a drop in the token price.  When blockchain security company PeckShield flagged that, pNetwork said it was the one behind the mint. 

“We noticed pGALA wasn’t to be considered safe anymore and coordinated the white hat attack to prevent pGALA from being maliciously exploited,” said the firm, which is a multi-chain routing protocol. The action was taken to help pNetwork drain a faulty PancakeSwap pool, it added, explaining the trouble was due to some kind of “misconfiguration of the p.Network bridge.”

The bridge said because pGALA wasn’t safe as such, it coordinated the white hat attack to prevent pGALA from being maliciously exploited. At the time, the platform also confirmed that a new pGALA token would be created to replace the older version.  New tokens will be airdropped in the coming days to those who had pGALA tokens before the incident, pNetwork added. pGALA is a BNB Chain-compatible version of the Ethereum-based token GALA, the utility token of the web3 gaming network Gala Games.

“All GALA tokens on Ethereum, as well as the underlying bridge collateral, are SAFE,” ensured pNetwork.

However, Gala Games wasn’t happy with how pNetwork handled the incident, and that pNetwork didn’t consult their team before minting the tokens. “We were not part of that process,” Jason Brink, the president of the blockchain at Gala Games, told The Defiant. “They operate totally independently from us.”

A “malicious hack,” Not a ‘white hat” Operation

Crypto exchange Huobi Global meanwhile believes it was rather an attack by pNetwork. “pNetwork’s action is not a “white hat” operation, but a malicious hack driven by profit and bad faith,” the exchange said in a statement.

To back its argument, Huobi said that the pNetwork team never shared its intention to exploit the loophole on its own smart contract and issue 55.6 billion PGALA tokens. The team didn’t leave sufficient response time to the exchanges either.  The project gave less than an hour for exchanges to respond, said Huobi. The exchange said neither Gala nor pNetwork teams reached out to Huobi, which decided to temporarily delist the token. 

Huobi further pointed to the postmortem investigation revealing that the misconfiguration was caused by a pNetwork engineer mistakenly embedding a key in the smart contract over two months back, which led to this incident.  But at the same time, there has been “no evidence that anyone would leverage this loophole to initiate an attack other than pNetwork, who is eager to exploit it for profit,” it said.  “It is unjustified and unnecessary for pNetwork to actively attack this loophole and mint an enormous amount of new tokens,” Huobi said, noting that through this attack, pNetwork multiple related addresses together profited in excess of $10 million.

As for draining a $400,000 liquidity pool, Huobi argues that pNetwork was “not entitled” to it. pNetwork counters saying that they will be returning all the BNB assets collected from the whitehat draining of the pool, which is approx. 0.00000109 BNB for each uncollateralized pGALA, to the victims, as part of their recovery plan.  But Huobi maintains that it was never a ‘white hat” operation but rather a “premeditated attack.” It was a “malicious hack” all along with “profit as its ultimate goal.” 

“All these seemingly preemptive actions are clearly profit-seeking behavior in disguise. What pNetwork has done is to carry out an actual hack under the guise of a “white hat” operation to avoid legal consequences,” said Huobi. 

The exchange urged all attackers to return the unjustified gains for which it would pay a $1 million bounty to the attackers and will not pursue any legal action against them. 

In response to the allegations made by Huobi, pNetwork called the exchange’s allegations untruthful. The DeFi protocol maintained that it acted in good faith and all actions were done in collaboration with Gala Games. The firm also said it would seek legal action against Huobi for its allegations.