{"investigation":{"slug":"gana-payment","entity_name":"GANA Payment","trust_score":5,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"GANA Payment was a BNB Smart Chain payment-focused DeFi project (BEP-20 token) that launched on November 11, 2025 and was exploited nine days later on November 20, 2025, resulting in losses exceeding $3.1 million. On-chain investigator ZachXBT confirmed the attack, which involved a compromised deployer private key combined with abuse of EIP-7702 to drain the project's staking contract; stolen funds were subsequently laundered through Tornado Cash on both BSC and Ethereum. The GANA token lost over 90% of its value within 24 hours of the exploit.","sections":[{"content":"GANA Payment positioned itself as a 'PayFi' (payment + DeFi) platform on BNB Smart Chain, claiming to reduce remittance delays, lower cross-border fees, and serve merchants in emerging markets through programmable transfers, verifiable transaction flows, and real-time auditing. The project operated a BEP-20 GANA token and a staking contract. GANA Payment launched on November 11, 2025. No security audit was published prior to launch. The project had no publicly disclosed team members or identities at the time of the exploit.","heading":"Overview","sources":[],"severity":"medium"},{"content":"On November 20, 2025, blockchain investigator ZachXBT publicly disclosed that GANA Payment had been exploited for over $3.1 million on BNB Smart Chain. ZachXBT traced the attack through on-chain analysis, identifying the consolidation wallet at BSC address 0x2e8a8670b734e260cedbc6d5a05532264aae5c38 as the primary aggregation point for stolen funds. The attack was first reported by ZachXBT via his Telegram channel and subsequently confirmed by multiple crypto news outlets including The Block, CryptoNews, and Lookonchain. The GANA token price collapsed from approximately $2.98 to $0.31 — a decline exceeding 90% — within 24 hours of the exploit becoming public, as tracked by DexScreener and GeckoTerminal.","heading":"The Exploit: ZachXBT Investigation","sources":[],"severity":"medium"},{"content":"Security firm Hacken published a detailed post-mortem identifying the precise attack mechanism. The attacker exploited a combination of a compromised deployer private key and abuse of EIP-7702, an Ethereum Improvement Proposal that allows externally owned accounts (EOAs) to temporarily execute smart contract code. The GANA staking contract used an `onlyEOA` guard (msg.sender == tx.origin) to restrict sensitive functions, but EIP-7702 allowed the attacker to run contract logic while preserving EOA status, bypassing this protection entirely. The attack proceeded in three steps: (1) the `setRatesPerSec` function was called to inflate the reward rate to an artificially extreme value of 10,000,000,000,000,000 (the internal variable `gana_Computility`); (2) the `unstake()` function was called, allowing extraction of massively inflated rewards as though they were legitimate staking proceeds; (3) the reward rate was immediately reset to normal values. The malicious delegator contract was deployed at 0x7a44bd9c6095ca7b2a6f62fe65b81924c6cab067, and eight pre-prepared theft accounts were hard-coded into the delegated contract logic, suggesting significant premeditation. The eight coordinated theft accounts included: 0x5d4041abd7094aa12496Ce919E88ee3E480c3e29, 0x0b8fa3F694Adb6BBEBe83628ee4ceecE33C4821F, 0x7b055955dc8ee2e3d4b139e42652cfb87f4eea3d, 0x8998adaf5a05e81f414bc042a4419c2931d96776, 0x46215669eb465970f924333e033eb0bfe4ec6c42, 0xcdf43fc9f0f2ea640ad33b115bae231881f78a2d, 0x7f4e661ba8ba136937ca86ec5e03a8d41e16ea10, and 0x5084c5809e14134644b1efb5b836964c141616fe. The root cause was determined to be either private-key theft of the deployer account (potentially via social engineering or phishing) or deliberate admin misuse — the protocol relied entirely on a single high-privilege key with no multi-signature controls or timelocks.","heading":"Technical Attack Vector","sources":[],"severity":"medium"},{"content":"Following the exploit, the attacker consolidated stolen USDT and GANA tokens across multiple BSC addresses before laundering across two chains. On BSC, 1,140 BNB (approximately $1.04 million) was deposited into Tornado Cash. The attacker then bridged the remaining funds to Ethereum using deBridge and/or Stargate protocols. On Ethereum, funds landed at address 0x5149A7696188F083297281D10293a20476252CDD and were distributed to multiple wallets including 0x7a503e3ab9433ebf13afb4f7f1793c25733b3cca and 0x98fc13632ff112e4667fc4f21ae980571f122b5a (which held approximately $2 million). An additional 346.8 ETH (approximately $1.05 million) was deposited into Tornado Cash on Ethereum in incremental batches of 1 ETH, 10 ETH, and 100 ETH to evade detection. At the time of initial reporting, approximately 346 ETH (roughly $1.046 million) remained dormant and unlaundered in an attacker-controlled Ethereum wallet. Analysts noted that the cross-chain bridge-and-mix pattern used closely mirrors other professional crypto theft operations.","heading":"Fund Laundering and On-Chain Tracing","sources":[],"severity":"medium"},{"content":"Following the exploit, GANA Payment stated it had engaged an independent third-party security firm to conduct an emergency investigation. The team committed to a 'comprehensive reboot plan' including full mapping of user asset addresses and recovery of funds where possible. No specific team members were publicly identified before or after the exploit. Security analysts and community observers urged the project to release a detailed post-mortem and halt affected contracts. Community commentary alleged the exploit exhibited characteristics consistent with an insider job, citing the eight pre-coded addresses embedded in the malicious contract and the systematic ownership rotation chain as evidence of insider knowledge. The project had no prior public security audit and was only nine days old at the time of the attack. GANA Payment lacked publicly available technical documentation prior to the exploit.","heading":"Project Response and Red Flags","sources":[],"severity":"medium"},{"content":"The GANA token lost more than 90% of its value within 24 hours of the exploit, falling from approximately $2.98 to $0.31 as tracked by DexScreener. Users who had deposited funds into the GANA staking contract lost access to their staked assets. The broader impact to BSC project users is consistent with a broader pattern: according to DefiLlama data cited in coverage, BNB Smart Chain projects collectively lost over $100 million to similar exploits in 2025. As of the last available reporting, a recovery timeline for affected users had not been publicly confirmed.","heading":"Market and User Impact","sources":[],"severity":"medium"}],"timeline":[{"date":"2025-11-11","event":"GANA Payment launches on BNB Smart Chain with GANA BEP-20 token and staking contract; no security audit published.","source":"","source_url":"https://rekt.news/gana-payment-rekt"},{"date":"2025-11-20","event":"Exploit occurs: attacker leverages compromised deployer private key and EIP-7702 abuse to drain $3.1M from GANA staking contracts on BSC.","source":"","source_url":"https://www.banklesstimes.com/articles/2025/11/20/gana-payment-drained-for-3-1m-in-bsc-exploit-zachxbt-confirms/"},{"date":"2025-11-20","event":"ZachXBT publicly discloses the exploit via Telegram; identifies consolidation wallet 0x2e8a8670b734e260cedbc6d5a05532264aae5c38 and Tornado Cash laundering on BSC (1,140 BNB, ~$1.04M).","source":"","source_url":"https://www.theblock.co/post/379619/gana-payment-exploit"},{"date":"2025-11-20","event":"Attacker bridges funds to Ethereum and deposits 346.8 ETH (~$1.05M) into Tornado Cash in incremental batches; ~346 ETH remains dormant in attacker wallet.","source":"","source_url":"https://coinfomania.com/gana-payment-exploited-for-3-1m-hacker-laundered-via-tornado/"},{"date":"2025-11-20","event":"GANA token collapses over 90% from ~$2.98 to ~$0.31 within 24 hours of exploit disclosure.","source":"","source_url":"https://www.banklesstimes.com/articles/2025/11/20/gana-payment-drained-for-3-1m-in-bsc-exploit-zachxbt-confirms/"},{"date":"2025-11-20","event":"GANA Payment team announces engagement of third-party security firm and pledges comprehensive reboot plan; no specific team members identified publicly.","source":"","source_url":"https://nulltx.com/gana-payment-hit-by-3-1m-exploit-as-attacker-launders-funds-across-chains/"},{"date":"2025-11-20","event":"Hacken publishes technical post-mortem detailing EIP-7702 exploit mechanism, eight coordinated theft addresses, and `setRatesPerSec` rate inflation attack.","source":"","source_url":"https://hacken.io/insights/gana-payment-hack-explained/"}],"sources_used":[],"source_tags":["zachxbt","defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet","created_at":"2026-05-04T02:54:20.345281+00:00","updated_at":"2026-08-29T01:35:38.329+00:00"}}