Five Billion Tokens From Nowhere: Inside the 2024 Gala Games Exploit

Imagine a central bank that left an old key to its printing press in a drawer for six months. One day, someone finds it, prints money, and starts spending. That, more or less, is what happened to Gala Games in May 2024.

An attacker gained control of a dormant minter account on the GALA token contract, an account with the power to create new tokens, and used it to create 5 billion GALA, worth about $216 million at the time. Before the account was frozen, about 592 million of those tokens had been sold for roughly $21.8 million in ETH.

Token prices are extremely volatile. Figures here are historical, dated to the incident.

Who Gala is

Gala Games is a blockchain games publisher that rode the 2021 boom, building a catalogue of titles around its own GALA token, including licensed games such as The Walking Dead: Empires. Because GALA was the common currency across that ecosystem, a sudden flood of new tokens threatened every game and player tied to it, not just one project.

How it happened

Security firm Hacken classed the incident as an access control attack. The account the attacker used had minting rights but had not been used for about 180 days. Somehow its keys fell into the wrong hands.

Once in control, the attacker minted 5 billion GALA to a new address, sent it 2 ETH, probably to pay transaction fees, and began selling the tokens in batches of about 100 ETH through a decentralised trading service. An eagle-eyed onlooker spotted the minting and the selling and raised the alarm.

The blocklist that saved the day

Gala's team had an emergency brake. About a year earlier, it had upgraded the token contract to a V2 version that included a blocklist function, letting administrators freeze a specific address. They used it 2 hours and 16 minutes after the first swaps, cutting the attacker off from the roughly 4.4 billion unsold tokens.

Then something unusual happened. The day after the exploit, the stolen ETH was sent back to the minter account. Gala described the incident as isolated and said it was working with law enforcement. GALA's price initially fell about 20%.

By the numbers

• 5 billion: GALA tokens minted by the attacker.
• About $216 million: their value at the time.
• 592 million: tokens sold before the freeze, for about $21.8 million in ETH.
• 180 days: how long the compromised minter account had sat unused.
• 2 hours 16 minutes: from the first swaps to the freeze.

Not the first scare

It was not Gala's first moment of panic. In November 2022, rumours that a wallet had minted more than $2 billion worth of GALA caused the token to crash about 25%, before the picture became clearer. Crypto markets react to the possibility of a mint almost as violently as to the mint itself.

The shutdowns that followed

The exploit came at a hard time for blockchain games generally. In the years after the 2021 boom, many publishers trimmed their portfolios, and Gala was no exception: it shut down The Walking Dead: Empires on 31 July 2025. The same day, Square Enix closed the servers of its own blockchain game, Symbiogenesis. These were not dramatic collapses, but they were part of a steady pattern of blockchain titles quietly going offline once their audiences thinned out.

WGC's take

The Gala exploit is really a story about keys. The token contract itself was not broken. An old account with powerful permissions was left alive long after anyone needed it, the same mistake that cost Ronin $625 million two years earlier. In both cases, the lesson is that every powerful permission should be removed the moment it is no longer needed.

It also exposes an awkward truth about blockchain games. The feature that saved Gala, a central blocklist, is the opposite of the "trustless" ideal these projects often advertise. Players were protected because a company could step in. That is probably the right trade-off for games, but it is worth being honest about. For the bigger picture, read our editorial on the lessons of blockchain gaming's crashes.