Gala Chain Exploit Exposes Security Flaw, Raises Concerns Over Automated Attackers

The blockchain developed by Gala Games suffered an exploit on August 18, where an attacker used 74 reusable authorization signatures gathered from failed transactions to drain about $3 million and dozens of other tokens from nine wallets. The attack was a result of a security flaw that had survived multiple audits.

GalaChain's system allowed the attacker to use historical signatures from unsuccessful transactions as reusable permissions, exposing a weakness in its signature verification and replay protection mechanisms. The attacker used AI-assisted tooling to automate submissions, draining 56 out of 59 account-token combinations targeted during the incident.

The attack was particularly notable because it highlighted the disparity between automated attackers and human-driven monitoring systems. While the attacker could submit transactions every few seconds, detection and emergency intervention often require human decisions, leading to a delay in responding to attacks.