GalaChain, the blockchain developed by Gala Games, said an Aug. 18 exploit drained about 2 billion GALA, worth about $3 million, and dozens of other tokens from nine wallets. The attacker reused 74 signatures from failed transactions, some as old as 55 days, exploiting a flaw in EIP-712 typed-data verification and a separate replay-protection weakness. Gala said 56 of 59 targeted account-token combinations were emptied on the first attempt, while 1,066 submissions arrived at a median interval of 4.5 seconds. The company paused its bridge about two hours and 47 minutes after the first verified unauthorized transfer and later patched both flaws. Gala said it found no evidence that private keys, seed phrases or passwords had been compromised, although part of that conclusion rests on unpublished internal evidence. The vulnerability had survived a CertiK authorization review in late 2025 and a Hashlock SDK review in January. Gala has added identity-based rate limits, behavioral monitoring and extra scrutiny for larger bridge withdrawals, while filing a complaint with the FBI’s Internet Crime Complaint Center and sending preservation and freeze requests to platforms across four chains. The incident highlights the difficulty of defending against automated attacks when valid signatures, mapped balances and machine-speed submissions outpace human-led detection and intervention.