
SlowMist founder Yu Jian reports the hack stemmed from a leaked Stake contract Owner key, enabling attackers to bypass security checks and withdraw large sums.
GANA Payment, a BNB Chain-based payment platform, lost over $3.1 million in a security breach disclosed by SlowMist founder Yu Jian. The exploit was traced to a leaked Stake contract Owner key, which hackers used with the 7702 delegate function to bypass onlyEOA verification and alter transaction rates and fees, enabling large unauthorized withdrawals. Prior reports noted attackers laundered the funds via Tornado Cash and cross-chain transfers to Ethereum, depositing 346 ETH worth $1.046 million while retaining another 346 ETH. The incident highlights critical contract key management vulnerabilities and ongoing risks in cross-chain asset workflows.