Gala: The issuance of 5 billion GALA tokens was an abuse of privileged access, not an external software vulnerability

According to official news, Gala released a post-event report on the unauthorized issuance of 5 billion GALA. The report pointed out that Gala had previously encountered a security incident involving a third-party contractor. At present, all internal processes have been repaired, including the removal of unauthorized users. The attacker has returned the ETH obtained from the sale of GALA, which has been used to repurchase and destroy tokens. The 5 billion GALA minted by the attacker will be destroyed. The attacker's contract and wallet have been immediately blacklisted, and the Ethereum contract remains secure through multi-signature contracts with geographically dispersed signers. Gala identified malicious actors through other activities and usage patterns within the network. These patterns were previously associated with smaller vulnerabilities, indicating privileged access abuse rather than external software vulnerabilities. After the attack, Gala immediately took action to freeze the hacker's funds and submitted the case to the US Department of Justice and the Federal Bureau of Investigation for further investigation. At the same time, Gala is conducting an internal review of security protocols and contract access rights to prevent future accidents. Measures include strengthening access control, key management practices, and implementing additional security measures for critical operations.