Yala Stablecoin to Hold Post Mortem X Spaces Event on October 3, 2025

Recently, the Crypto Assets market witnessed another notable security incident. The GAIN Token project suffered a serious cross-chain vulnerability attack, which bears a striking resemblance to the previous Yala incident. Both incidents involved a vulnerability in the LayerZero cross-chain Peer configuration, and the attacker cleverly exploited this vulnerability to implement a "fake token + cross-chain mapping + target chain minting" attack chain. The attack process is roughly as follows: the attacker first minted a new Token named TTTTT on the Ethereum network, and then sent a cross-chain message through a maliciously configured LayerZero Peer node. This message successfully bypassed security verification, ultimately minting up to 5 billion GAIN Tokens on the BSC chain and transferring these Tokens to the attacker's address. Although both incidents exploited vulnerabilities in LayerZero, there are differences in the details. In the Yala incident, the attacker was able to register Peer nodes independently, while the GAIN incident resembled a 'permission leak', as authorizations were required to complete Peer permission initialization on the Ethereum side. This suggests that the GAIN project team likely made a significant oversight at some point, allowing the attacker to gain critical permissions. Although some investors have profited from bottom-fishing after the coin price plummeted, such behavior is akin to licking blood from a knife's edge. Security experts strongly advise that investors should avoid any transactions with GAIN Token until the project team takes effective measures. If the project team fails to respond in a timely manner, the price of GAIN Token may continue to decline. This incident once again highlights the challenges of cross-chain technology in terms of security. With the continuous development of decentralized finance, project teams and developers need to pay more attention to security audits and vulnerability detection to prevent similar incidents from happening again. At the same time, investors should also enhance their risk awareness and participate cautiously in emerging Crypto Assets projects.

#数字货币市场回调 This morning, a user in the community mentioned that buying the dip on $GAIN resulted in multiple times returns, but such actions carry significant risks. According to GoPlusZH's analysis, this $GAIN incident is similar to the previous $Yala incident, both involving the exploitation of LayerZero cross-chain Peer configuration vulnerabilities. The attack process is roughly as follows: the attacker first mints a new token named $TTTTT on the Ethereum chain, then sends cross-chain messages through a maliciously configured LayerZero Peer, cleverly bypassing the verification mechanism, and ultimately mints 5 billion $GAIN tokens to the attacker's address (0xF3d173) on the BSC chain. In comparison to the previous $Yala incident, there are significant differences between the two attacks: in the $Yala incident, the attacker was able to register a Peer on their own, while the $GAIN incident is more like a permission leakage issue, as the initialization of Peer permissions on the Ethereum side requires authorization. This indicates that there are vulnerabilities in the project's system security that have been exploited by attackers, but the specific reasons remain unclear. Although some have profited by buying the dip, this behavior is extremely risky. The current market risks are very high, and investors are advised to avoid trading this token. If the Griffin_AI project team does not take effective measures, the coin price is likely to continue to decline. In the crypto market, security is always the top priority. Such events remind us once again that even mature cross-chain protocols may have exploitable vulnerabilities. Investors must remain vigilant, and project teams should strengthen security audits and the speed of vulnerability fixes.

Recently, the crypto assets market witnessed another complex cross-chain attack incident. A newly created Ethereum address received ETH from Tornado Cash in just 13 hours, and then exchanged it for BNB through the Symbiosis protocol. The key to this operation lies in the fact that the attacker discovered a minting vulnerability in a certain token. They minted 5 billion coins at 07:04 and started to sell off just 22 minutes later. The continuous selling for 55 minutes brought the attacker an improper benefit of approximately $3.01 million. What is more concerning is that the attackers acted quickly to disperse the profits across multiple blockchain networks through the deBridge protocol, attempting to obscure the transaction trail. There are signs that some of the funds have already flowed into mixing services such as Tornado Cash, which may complicate the recovery of the funds. It is worth noting that this attack pattern is quite similar to the previous Yala incident, both involving unauthorized initialization and malicious exploitation of LayerZero Peer. Experts analyze that this is likely not a self-directed performance by the project team, but rather a real security vulnerability being maliciously exploited. This event again highlights the importance of cross-chain protocols and smart contract security. With the continuous development of the DeFi ecosystem, similar attacks may become more complex and frequent. Therefore, project teams need to design and audit their smart contracts more carefully, while users should remain vigilant and cautiously participate in emerging DeFi projects.

News Preview: Exchanges such as Binance will list 0G (0G) at 6 PM on September 22 (UTC+8); The Korea Blockchain Week (KBW 2025) will kick off on September 22, with guests including Donald Trump Jr. and Bo Hines. The Layer 1 stablecoin payment project Plasma will launch its TGE on September 25th at 8 PM (UTC+8); Particle Network (PARTI) will unlock approximately 182 million tokens at 6 PM Beijing time on September 25, which accounts for 78.44% of the current circulation, valued at approximately 34 million USD.

The scam Token #YALA was ultimately rejected.