GANA Payment Hit by $3.1M Exploit as Hacker Uses Tornado Cash

Another day, another crypto heist—but this one's got regulators sweating bullets.

The $3.1 Million Vanishing Act

Tornado Cash strikes again, proving that privacy tools remain the Swiss Army knife for digital bandits. The mixer effectively laundered the entire haul while GANA's security team scrambled to plug the leak.

DeFi's Recurring Nightmare

Smart contracts? More like smart vulnerabilities when $3.1 million can disappear faster than a banker's conscience during bonus season. The exploit exposes the persistent gap between theoretical security and practical execution in decentralized finance.

Until projects start treating security audits like actual requirements rather than marketing checkboxes, these headlines will keep coming—much to the delight of anonymized wallet holders everywhere.

What is GANA payment?

GANA Payment is a BSC-based Web3 payment project that basically helps people send crypto quickly and lets merchants accept payments easily. While not a major name in the payments industry, it has an active niche user base within the BSC ecosystem.

How the attack was first detected

The exploit came to public attention when Vlamidir S shared that the project had been drained and that ZachXBT was already monitoring the on-chain activity. 

Zach, widely respected for his ability to trace stolen funds across multiple chains, began mapping the attacker’s movements as soon as unusual wallet activity appeared.

How the funds were moved

According to early findings, the attacker consolidated the stolen assets into a primary address: 0x2e8a8670b734e260cedbc6d5a05532264aae5c38

According to @zachxbt , the project 'GANA Payment' was exploited a few hours ago for ~$3.1M+ on BSC!

Theft consolidation
0x2e8a8670b734e260cedbc6d5a05532264aae5c38

The attacker deposited 1140 BNB ($1.04M) to Tornado on BSC and bridged funds to ethereum where another 346.8 ETH… pic.twitter.com/lUBy3s3GZW

From the main consolidation wallet, the attacker immediately began moving the stolen funds through laundering channels. The first step was sending 1,140 BNB, worth roughly $1.04 million, into Tornado Cash on Binance Smart Chain. 

Tornado Cash is often used in such incidents because it mixes deposits in large pools, making it difficult to trace where the funds originally came from.

After masking the trail on the BSC, the attacker shifted part of the loot to the Ethereum network. Once the assets landed there, another 346.8 ETH (around $1.05 million) was pushed through Tornado Cash again, repeating the same mixing strategy. 

Using mixers across multiple chains is a common tactic among exploiters, as it breaks the transaction path in several places and makes on-chain tracking far more complicated.

Funds still sitting idle

Even after all the mixing, a sizeable portion of the stolen money hasn’t moved at all. Investigators have pointed out that 346 ETH, valued at roughly $1.046 million, is still untouched at the address: 0x7a503e3ab9433ebf13afb4f7f1793c25733b3cca

Funds sitting idle like this usually suggest the attacker is waiting for the noise to slow down or searching for a new route to MOVE the assets without drawing attention.

What the GANA team has said

In response to the exploit, GANA Payment issued an urgent notice confirming that its interaction contract was compromised, allowing an external attacker to steal assets. 

The team stated that both their internal engineers and an independent security firm are now conducting an emergency investigation to understand how the breach occurred, identify weaknesses, and measure the full extent of the damage.

GANA Urgent Announcement

GANA’s interaction contract has been targeted by an external attack, resulting in unauthorized asset theft. Our technical team, together with an independent third-party security firm, has initiated an emergency investigation to analyze the attack vector,…

GANA said it will keep users updated through official channels as the investigation progresses. 

To move forward, GANA says it is preparing a full reboot of the project. Part of that process involves compiling a complete list of all user asset addresses and checking the permissions linked to them.

The team added that it will soon share a clear recovery plan with timelines and actionable steps, aiming to protect users and eventually restore all affected assets.

Also Read: Hacker Bypasses Sonic Labs Wallet Freeze, Moves 21M $S Token