Worked example · 2024-05

Gala Games admin-key compromise emergency-recovery — Ethereum — 2024-05-20

Loss: approximately $200M nominal extracted from the GALA ERC-20 token contract on Ethereum on 2024-05-20 by a compromised admin key that retained mint authority on the deployed token contract. The attacker minted approximately 5 billion GALA tokens to an attacker-controlled address; the nominal valuation was based on the spot GALA price at the moment of the mint, but the realised on-chain extraction was substantially smaller because the attacker had to dump the freshly-minted supply against finite on-chain liquidity in a window short enough that Gala's operator-side response landed before the dump ran to completion. The attacker was reported to have realised on the order of ~$23M in ETH from the dump portion that did execute before the operator response.
Recovery: approximately the full nominal mint was reversed via emergency-reverse-mint within hours of the on-chain manifestation. Gala Games' operator team retained on-contract authority sufficient to burn the attacker-minted supply and restore the pre-event token-supply state for the non-dumped portion; the dumped portion (~$23M in proceeds at the realised dump price) entered the attacker's downstream pipeline and was the subject of subsequent law-enforcement engagement rather than on-chain recovery. Net retained-loss to the protocol-and-user perimeter on the on-chain layer was therefore approximately the dumped portion, not the nominal-mint headline figure.
OAK Techniques observed: OAK-T11.002 (Wallet-Software / Signing-Surface Compromise) broadly construed in the admin-key sub-class — the proximate cause was loss of control of an admin key that retained mint authority on the deployed GALA contract; the key's specific compromise vector was attributed by Gala Games to a former-employee surface, with the admin-key control surface being the structural defect rather than the per-key compromise mechanism. OAK-T9.004 (Access-Control Misconfiguration) — the structural precondition: the production GALA contract retained an open mint capability under a single admin key surface long after the protocol's operational maturity should have rotated to a more constrained access-control configuration (multisig, time-locked mint, capped supply on-contract). The combination of T11.002 + T9.004 is the canonical OAK pattern for admin-key-with-mint-authority incidents.
Attribution: pseudonymous. Gala Games publicly attributed the incident to a former-employee surface; the on-chain attacker address was not associated by Gala with a public named-individual identity at the time of acknowledgement. There is no public OAK-G01 / state-actor attribution. The attribution is operationally distinct from typical pseudonymous attribution because the operator side asserts insider-origin without making the named-individual claim public; OAK records this as pseudonymous-internal to capture the dimension that the entry vector is internal-to-the-operator rather than external-cluster.
Key teaching point: emergency-recovery via centralised on-contract authority is a real recovery primitive, but its existence is itself a security trade-off, not a free defence. The Gala 2024 case is the canonical OAK 2024 worked example for this dual-edged property. The same on-contract authority that allowed the operator team to reverse-mint and burn the attacker-minted supply within hours is the same authority surface that — under a different compromise vector — could itself be the entrypoint for an attacker-driven mint or burn against legitimate holder balances. The recovery primitive is conditional on the authority remaining in trusted operator hands; an attacker who compromises the recovery authority itself eliminates the primitive. Defender threat models should treat admin-with-mint-authority as a compounded surface: it is both the residual-risk surface for the production token-supply invariant and the recovery-primitive surface for incident response, and the trade-off should be made explicitly and revisited as the protocol matures.

Summary

Gala Games is a blockchain-gaming ecosystem operating across multiple chains; the GALA token is the principal in-ecosystem asset, deployed as an ERC-20 contract on Ethereum with substantial on-chain liquidity on Uniswap and other AMM venues. On 2024-05-20 an attacker, in control of an admin key associated with the production GALA contract, executed a mint transaction that produced approximately 5 billion new GALA tokens to an attacker-controlled address. At the spot GALA price at the moment of the mint, the nominal value was approximately $200M; the realised on-chain extraction was bounded by available AMM liquidity and the latency of the operator-side response.

The attacker began dumping the freshly-minted supply against on-chain liquidity. Within hours of the on-chain manifestation, Gala Games' operations team detected the anomalous mint, identified the compromised admin-key surface, and executed a reverse-mint operation: using the non-compromised authority surface still in operator hands, the team burned the attacker-controlled balance, restoring the non-dumped portion of the supply to the pre-event state. The portion that had been dumped before the operator response was no longer recoverable on-contract — the GALA had been swapped for ETH on AMM venues and the ETH was in the attacker's wallet — and was the subject of subsequent law-enforcement engagement rather than on-chain reverse-mint.

For OAK's purposes the case sits at the intersection of T11.002 (admin-key compromise as the entry vector) and T9.004 (the structural access-control configuration that left an open mint capability under a single admin key surface). The novel OAK contribution of the worked example is documenting the emergency-recovery-via-centralised-authority primitive as a real but conditional defensive surface, and articulating the dual-edged trade-off explicitly: the same on-contract authority that allowed the recovery is the same authority that, under a different compromise vector, would itself be the attack surface. The protocol-side decision to retain such authority is a defensible decision if made explicitly and reviewed at protocol-maturity inflection points; the failure mode is retaining the authority by default long after the operational maturity at which the trade-off should have been revisited.

The case is also the canonical 2024 example for Gala Games' specific attribution dimension: the operator side publicly framed the incident as former-employee-origin without committing to a public named-individual claim, producing a pseudonymous-internal attribution status that is structurally distinct from external-cluster pseudonymous attribution. OAK records this dimension explicitly because the defender threat-model implications differ — internal-origin attribution shifts the corresponding Mitigations layer toward off-boarding-process discipline, key-rotation-on-personnel-change, and access-revocation-audit, rather than toward external-perimeter hardening.

Timeline (UTC)

When	Event	OAK ref
Pre-event	GALA ERC-20 token contract deployed on Ethereum with admin-key-controlled `mint` authority retained on the production contract; admin-key surface includes keys held by operations and (per Gala Games' subsequent attribution) at least one former-employee-associated key whose access-revocation status was operationally incomplete	T9.004 surface (latent admin-key configuration)
Pre-event	Gala Games protocol matures with substantial on-chain liquidity and active token-holder base; admin-key configuration is not retrofitted to a more constrained access-control surface (multisig, time-locked mint, capped supply on-contract)	(residual T9.004 surface)
2024-05-20 (attack-tx window)	Attacker, in control of compromised admin key, submits `mint` transaction producing ~5 billion GALA tokens to attacker-controlled address; nominal value at spot price ~$200M	T11.002 + T9.004 extraction
2024-05-20 (within attack window)	Attacker begins dumping minted supply against Uniswap and other AMM venues; ~$23M in ETH realised before operator response lands	T5.001 (downstream dump against AMM liquidity)
2024-05-20 (within hours)	Gala Games operations team detects anomalous mint via on-chain monitoring; confirms compromised admin-key surface; engages emergency response	(operator response)
2024-05-20 (within hours)	Gala Games executes reverse-mint operation against attacker-controlled balance using non-compromised on-contract authority; non-dumped portion of attacker-minted supply burned; pre-event supply state restored for that portion	emergency-recovery-via-centralised-authority
2024-05-20 (same-day acknowledgement)	Gala Games CEO publicly acknowledges the incident; attributes the entry vector to a former-employee admin-key surface; commits to law-enforcement engagement on the dumped portion	(operator-side public-acknowledgement)
2024-05-20 onward	PeckShield, BlockSec, on-chain analyst threads publish post-incident write-ups confirming the on-chain mint-and-reverse-mint sequence	(transparency / cohort signal)
2024-05 onward	Gala Games engages law enforcement on the dumped-portion proceeds; rotates admin-key configuration; reviews access-revocation processes	(operator response continuing)
Continuing	Dumped-portion proceeds (~$23M) not recovered on-chain; non-dumped portion fully reversed	(recovery state — partial)

What defenders observed

Admin-key-with-mint-authority on a mature production token is a compounded risk surface. The production GALA contract retained mint authority under a single-admin-key surface long past the protocol-maturity inflection point at which the trade-off should have been revisited. The structural failure was not the per-key compromise — that is downstream — but the access-control configuration choice that left the open-mint capability in production with insufficient defence-in-depth. The Mitigation-layer lesson is that admin-with-mint-authority should either (a) be retired entirely once the protocol reaches a maturity at which the recovery primitive's expected value falls below the residual-risk expected value, or (b) be retained explicitly with multi-party authority (multisig with M-of-N high-N), per-mint amount caps, time-locks on mint calls, and on-chain monitoring that flags any mint operation against a public-acknowledgement-and-authorisation-audit pipeline.
The reverse-mint primitive worked because authority was held in non-compromised hands. Gala Games' ability to execute reverse-mint within hours was downstream of the structural property that the recovery authority was not the same key as the compromised mint authority — the operations team had access to a non-compromised authority surface that could burn the attacker-controlled balance. This property is not automatic; in a single-admin-key configuration where the compromised key was also the recovery key, no reverse-mint primitive would be available. Defender architecture for any retained on-contract authority should preserve the separation-of-authority property between the high-risk operational surface (mint) and the emergency-recovery surface (burn / freeze / role-revocation).
The dumped portion is the structural recovery-bound. The reverse-mint primitive operated on the on-contract balance still held by the attacker; tokens already dumped against AMM liquidity were no longer in attacker hands and therefore could not be reverse-burned without affecting downstream-buyer balances. The structural recovery-bound for any reverse-mint-style primitive is the latency window between the attack transaction and the operator response: faster operator response means more of the attacker-controlled balance is still on-chain in attacker hands and recoverable. Gala Games' realised loss is the dumped portion that escaped this window. The Mitigation-layer lesson is that operator-response time is the load-bearing variable for recovery rate in admin-key-mint cases, and operator-side preparation (alerting, on-call rotation, pre-authorised reverse-mint transaction templates) determines the bound.
Pseudonymous-internal attribution is a distinct dimension OAK should record explicitly. Gala Games publicly framed the incident as former-employee-origin; the on-chain attacker address was not associated with a public named-individual identity. The defender-threat-model implications are structurally distinct from external-cluster pseudonymous attribution: the response mitigation set shifts toward off-boarding-process discipline, periodic access-revocation audit, and key-rotation-on-personnel-change rather than toward external-perimeter hardening. OAK should preserve this attribution dimension as a first-class status alongside pseudonymous and confirmed-named-individual; contributors writing future T11.002 worked examples should consider whether the entry vector is internal-to-the-operator and record the dimension where applicable.
The OFAC-issue framing is structurally bypassed in this case. Some 2024 incidents involve attribution dimensions that touch OFAC-sanctioned addresses or jurisdictions and that constrain the operator's recovery options (e.g., recovery negotiations cannot route through sanctioned addresses). The Gala case is structurally outside that frame — the attacker surface was an internal-origin admin-key compromise, the recovery primitive operated on-contract via burn, and the dumped-portion law-enforcement engagement is a domestic-civil-recovery surface. Contributors should not over-extrapolate the Gala recovery shape to incidents where OFAC dimensions are in play.

What this example tells contributors writing future Technique pages

T11.002 covers admin-key-compromise as a sub-class distinct from end-user-wallet-software compromise. The Gala 2024 case is the canonical 2024 worked example for the operator-side admin-key sub-class. The standard T11.002 framing is end-user wallet software (e.g., supply-chain compromise of a wallet package, malicious browser extension, mnemonic-extraction malware). The Gala case is the operator-side companion: the same structural class — control of a signing surface that produces valid transactions against an on-chain authority — manifesting at the protocol-operator perimeter rather than at the end-user perimeter. T11.002 worked examples should preserve the operator-side / end-user-side sub-class distinction.
T9.004 and T11.002 together are the canonical OAK admin-key-mint pattern. The Gala case is the cleanest 2024 worked example. T9.004 covers the structural access-control configuration choice (open mint under single-admin-key surface in production); T11.002 covers the per-key compromise that converts the configuration into an extraction. Worked examples for either Technique should preserve the precondition / extraction distinction — without the T9.004 configuration, the T11.002 compromise produces a smaller-scope incident; without the T11.002 compromise, the T9.004 configuration is latent residual risk. Future contributor guidance should consider a cross-cutting Mitigation reference for admin-key-with-elevated-authority spanning the two Techniques.
Emergency-recovery primitives are a discrete defensive-design dimension that the Mitigations layer should cover explicitly. The four recovery primitives visible in the OAK 2022–2025 corpus to date are (a) post-extraction recovery-negotiation with attacker self-identification (Euler 2023), (b) in-mempool MEV-searcher-rescue under operator-public-acknowledgement (Ronin 2024 at /examples/2024-08-ronin-bridge-rescue.md), (c) validator-coordinated freeze on permissioned-validator-set L1s (Cetus 2025), and (d) on-contract centralised-authority emergency-recovery (Gala 2024 — this case). The Gala case is the canonical 2024 worked example for the fourth primitive. Contributors writing the Mitigations layer should consider an integrated Recovery-Primitives entry covering all four sub-cases and articulating their conditional prerequisites honestly.
Pseudonymous-internal as an attribution status deserves explicit recognition. The Gala case is the OAK 2024 anchor for this attribution dimension. Contributors writing future worked examples where the operator side publicly attributes incident origin to internal-to-operator surface (former employee, current employee, contractor, supply-chain insider) without making the named-individual claim public should record the attribution as pseudonymous-internal, distinct from external-cluster pseudonymous and from confirmed-named-individual. The Mitigations-layer implications differ enough — internal-origin shifts the response toward off-boarding-process discipline — to justify the dimension as a first-class status.

Public references

[galagamesofficial2024] — Gala Games official statement on the May 2024 admin-key incident, including the former-employee attribution framing and the reverse-mint timeline.
[peckshieldgala2024] — PeckShield headline figures and on-chain analytics for the Gala May 2024 mint and the reverse-mint sequence.
[blocksecgala2024] — BlockSec / on-chain forensic analysis of the Gala mint-and-reverse-mint transaction trace.
[slowmistgala2024] — SlowMist incident analysis covering the dumped-portion proceeds tracking.
[rektgala2024] — Rekt News public-facing summary framing the case as an admin-key-mint compromise with on-contract reverse-mint recovery.
[zachxbtgala2024] — ZachXBT / on-chain analyst thread tracking the attacker-controlled address and the dump-portion outflow.
[cointelegraphgala2024] — Cointelegraph / industry press coverage of the Gala CEO public acknowledgement and the law-enforcement engagement framing.

Discussion

Gala Games 2024 is OAK's canonical case for the emergency-recovery-via-centralised-on-contract-authority primitive paired with the pseudonymous-internal attribution dimension and the admin-key-with-mint-authority structural risk surface. The case is operationally instructive because it makes the dual-edged property of retained on-contract authority explicit and concrete: the same authority surface that allowed the recovery is the same authority surface that, under a different compromise vector, would have been the attack entrypoint. Defender threat models that treat admin-with-mint-authority as a one-dimensional residual-risk surface miss the dimension that the surface is also the recovery primitive; defender threat models that treat the recovery primitive as a free defence miss the dimension that retaining the surface compounds the risk.

The structural parallel with Ronin 2024 at /examples/2024-08-ronin-bridge-rescue.md is worth flagging at the corpus level. Both 2024 cases involve high-loss-shaped exploits with substantial recovery — Ronin via the in-mempool MEV-searcher-rescue primitive, Gala via the on-contract centralised-authority primitive. Both rely on operator-side preparation (Sky Mavis's pre-acknowledgement template; Gala's separated-authority architecture and on-call response capacity) for the primitive to activate. Both deliver substantial but not total recovery (Ronin: ~100% on the front-run target; Gala: full reverse-mint on the non-dumped portion, partial on the dumped portion). The two cases together illustrate that 2024 was a year in which the OAK corpus visibly expanded its catalogue of real on-chain recovery primitives beyond the post-extraction-laundering recovery-negotiation pattern that Euler 2023 anchored — recovery primitives can operate in the in-mempool window (Ronin) and in the on-contract-authority window (Gala) as well as in the post-laundering window (Euler).

The pseudonymous-internal attribution dimension at Gala is a corpus-level signal that deserves explicit framing in future contributor guidance. Internal-origin attribution shifts the Mitigations-layer response set in ways that external-cluster pseudonymous attribution does not: the load-bearing improvements are off-boarding-process discipline, key-rotation-on-personnel-change, periodic access-revocation audit, and the structural decision to constrain admin-with-mint-authority to multi-party surfaces that no single departing employee can compromise. These are organisational / operational improvements rather than smart-contract / infrastructure improvements, and OAK's coverage of them is currently thinner than its coverage of the smart-contract layer. The Gala 2024 case is the canonical 2024 anchor for the dimension; future contributors writing internal-origin worked examples should cross-reference it.

For OAK's broader credibility, including Gala 2024 in the worked-examples layer closes three gaps: it adds a 2024 admin-key-compromise worked example to a corpus that otherwise emphasises smart-contract-bug and bridge-validator-key incidents, it documents the on-contract centralised-authority emergency-recovery primitive as a real defensive surface visible in the 2024 cohort, and it anchors the pseudonymous-internal attribution dimension as a first-class status alongside the more familiar external-cluster pseudonymous dimension.