{"investigation":{"slug":"pnetwork","entity_name":"pNetwork","trust_score":12,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"pNetwork is a cross-chain bridge and interoperability protocol built on the pTokens architecture, enabling assets to move between Bitcoin, Ethereum, BNB Chain, and other networks via wrapped synthetic tokens. The protocol has suffered two major security incidents — a September 2021 pBTC-on-BSC hack losing approximately $12 million, and a November 2022 pGALA incident that triggered a $28 million lawsuit by Gala Games and Huobi alleging pNetwork's own engineers caused the vulnerability through a leaked private key, then allegedly profited from a self-described 'white hat' rescue. As of 2025, the PNT governance token trades at a fraction of its 2021 peak and the protocol operates with negligible market capitalization and trading volume.","sections":[{"content":"pNetwork is a decentralized cross-chain protocol that issues 'pTokens' — 1:1 pegged synthetic representations of assets on foreign blockchains. For example, pBTC represents Bitcoin on Ethereum or BNB Chain, while pGALA represented the GALA gaming token bridged to BNB Chain. The protocol is governed by the PNT token via a DAO and is maintained by the pNetwork Community Association, a Swiss entity. The underlying technology was developed by Provable Things (formerly Oraclize), a blockchain oracle company co-founded by Thomas Bertani that was acquired by the Poseidon Group in 2019. A network of node operators is responsible for verifying cross-chain transfers and guaranteeing the 1:1 peg. The protocol claimed to have processed over $1 billion in cross-chain volume and to safeguard over $100 million in TVL at its peak.","heading":"Overview","sources":[{"url":"https://medium.com/pnetwork/introducing-ptokens-provable-portable-pegged-70911e200933","name":"medium.com","type":"other","credibility":3},{"url":"https://www.bitget.com/price/pnetwork/what-is","name":"bitget.com","type":"other","credibility":3},{"url":"https://medium.com/pnetwork/pnetwork-powered-bridges-a-force-to-be-reckoned-with-fb5fb325d257","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On September 19, 2021, an attacker exploited a critical vulnerability in pNetwork's cross-chain bridge and stole 277 pBTC — worth approximately $12–$12.7 million at the time — from the pBTC bridge deployed on Binance Smart Chain (BSC). The vulnerability resided in the Rust code that processed peg-out event logs: the code did not validate that peg-out requests originated from authorized pNetwork smart contracts. An attacker deployed their own malicious contracts that emitted event logs in the same format as legitimate peg-out requests. Because the protocol processed all matching events without origin verification, the attacker's forged withdrawal instructions were fulfilled, and the collateral BTC was transmitted to an address under the attacker's control. pNetwork stated that other bridges and funds were unaffected. The team identified and patched the bug, deactivated all cross-chain infrastructure preemptively, and then reactivated bridges with slower, more cautious transaction processing. pNetwork publicly offered the attacker a 'clean $1,500,000 bounty' for the return of all stolen funds, framing this as a good-faith appeal for ecosystem growth, though the funds were not returned. Security firm Halborn subsequently published a technical post-mortem confirming the event-log spoofing root cause.","heading":"September 2021 pBTC-on-BSC Hack (~$12 Million)","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-pnetwork-hack-september-2021","name":"halborn.com","type":"other","credibility":3},{"url":"https://medium.com/pnetwork/pnetwork-post-mortem-pbtc-on-bsc-exploit-170890c58d5f","name":"medium.com","type":"other","credibility":3},{"url":"https://cryptoslate.com/12-million-stolen-after-binance-smart-chain-defi-pnetwork-gets-hacked/","name":"cryptoslate.com","type":"other","credibility":3},{"url":"https://decrypt.co/81301/defi-bridging-protocol-pnetwork-suffers-12-million-hack","name":"decrypt.co","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2021/09/20/cross-chain-protocol-pnetwork-loses-12m-to-hack","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.theblock.co/post/118060/defi-pnetwork-hack-wrapped-bitcoin-12-million-lost","name":"theblock.co","type":"other","credibility":3}],"severity":"medium"},{"content":"On November 3, 2022, a wallet address minted approximately 55.6 billion pGALA tokens — a wrapped version of the GALA gaming token bridged from Ethereum to BNB Chain via pNetwork — and swapped a large portion for BNB on PancakeSwap, crashing the GALA token price by as much as 94–97% and draining roughly 12,976–12,977 BNB (approximately $4.3–$4.5 million) from the liquidity pool. The apparent nominal value of the minted tokens was cited as exceeding $1 billion at pre-crash prices. pNetwork described its actions as a 'white hat' self-rescue: the team alleged it discovered a misconfiguration in the pGALA contract — specifically that a private key controlling the contract's DEFAULT_ADMIN_ROLE and MINTER_ROLE had been accidentally embedded publicly in pNetwork's GitHub repository — and that it moved first to drain the liquidity before a malicious actor could do so. pNetwork stated it planned to reimburse all affected liquidity providers and that the underlying GALA collateral on Ethereum was safe. Huobi (now HTX), a major exchange holding pGALA positions for its users, disputed this account. Huobi alleged that pNetwork's actions constituted a 'premeditated attack' rather than a good-faith rescue, pointing out that: (1) the private key had been publicly accessible on GitHub for over two months with no known third-party exploitation during that window; (2) pNetwork did not alert Huobi until 50 minutes before the incident despite direct communication channels; (3) minting 55.6 billion tokens to front-run a pool worth approximately $400,000 was disproportionate; and (4) the operation yielded pNetwork and associated parties over $4.5 million, with Huobi alleging total profits across involved parties exceeded $10 million. pNetwork denied profiting, stating the recovered BNB would be returned to users, and condemned Huobi's characterization as false, indicating it would pursue its own legal action. The technical root cause — the accidental public leak of the proxy admin private key on GitHub in August 2022 — is confirmed by on-chain analysis from BlockSec.","heading":"November 2022 pGALA Incident: Private Key Leak, Alleged White Hat, and Disputed Profit","sources":[{"url":"https://www.theblock.co/post/182969/developers-of-pnetwork-bridge-drain-4-3-million-from-pancakeswap-in-white-hat-attack","name":"theblock.co","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/report-gala-token-exploit-resulted-from-public-leak-of-private-key-on-github","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.securities.io/huobi-says-pnetwork-hacked-gala-in-a-premeditated-attack-to-make-profits/","name":"securities.io","type":"other","credibility":3},{"url":"https://cryptoslate.com/per-huobi-alleges-pnetwork-made-over-4m-from-its-gala-white-hat-attack/","name":"cryptoslate.com","type":"other","credibility":3},{"url":"https://medium.com/pnetwork/lessons-learnt-from-the-pgala-exploit-50e686730b98","name":"medium.com","type":"other","credibility":3},{"url":"https://thedefiant.io/news/defi/pnetwork-misconfiguration-gala-1b-hack","name":"thedefiant.io","type":"other","credibility":3}],"severity":"medium"},{"content":"On March 20, 2023, Gala Games filed a lawsuit against pNetwork on behalf of pGALA victims, seeking $27.7 million in damages on grounds of negligence and tortious interference with business expectancy. Gala Games alleged pNetwork failed to address a known misconfiguration, that the false appearance of a $1 billion hack caused severe market disruption to the GALA token, and that Gala incurred over $25 million in out-of-pocket costs addressing the aftermath. Huobi subsequently joined as a co-plaintiff. On April 3, 2023, Huobi and Gala Games announced a joint $50 million compensation plan for affected users: Huobi contributed $25 million (including $15 million USDT and $10 million in equity compensation) and Gala Games contributed $25 million in node license compensation. As of the time of this investigation, no public record of a final court judgment or settlement in the case has been identified in available sources. All allegations against pNetwork remain unproven in a court of law.","heading":"Gala Games and Huobi Lawsuit ($28 Million)","sources":[{"url":"https://www.prnewswire.com/news-releases/gala-sues-pnetwork-on-behalf-of-pgala-victims-301775263.html","name":"prnewswire.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2023/04/03/huobi-and-gala-games-to-give-50m-to-victims-of-pgala-scheme","name":"coindesk.com","type":"other","credibility":3},{"url":"https://playtoearn.com/news/gala-games-files-28-million-lawsuit-against-pnetwork-over-code-misconfiguration","name":"playtoearn.com","type":"other","credibility":3},{"url":"https://cryptorank.io/news/feed/682bd-178077-huobi-and-gala-games-file-lawsuit-pnetwork","name":"cryptorank.io","type":"other","credibility":3},{"url":"https://cryptonews.net/news/gamefi/20692175/","name":"cryptonews.net","type":"other","credibility":3}],"severity":"medium"},{"content":"pNetwork's incident history reveals a pattern of significant operational security deficiencies. In the September 2021 hack, the root cause was a failure to implement basic input validation — the Rust code processing cross-chain event logs made an implicit trust assumption that all peg-out events originated from pNetwork's own contracts, an assumption never enforced in code. In the November 2022 pGALA incident, a plaintext private key controlling privileged smart contract roles (DEFAULT_ADMIN_ROLE and MINTER_ROLE) was committed to a public GitHub repository and remained exposed for at least two months before the incident. These are considered fundamental security failures: committing private keys to public repositories and failing to validate transaction origins are well-documented attack vectors in every bridge security checklist. Following the 2021 hack, pNetwork committed to engaging additional security auditing firms and launching a bug bounty program. Whether those measures were in place by the time of the November 2022 pGALA incident is not confirmed in available sources.","heading":"Operational Security and Engineering Failures","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-pnetwork-hack-september-2021","name":"halborn.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/report-gala-token-exploit-resulted-from-public-leak-of-private-key-on-github","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://medium.com/pnetwork/pnetwork-post-mortem-pbtc-on-bsc-exploit-170890c58d5f","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The PNT governance token reached its all-time high in 2021 during the broader DeFi bull market, trading near $0.92–$0.98. Following the September 2021 hack, PNT entered a prolonged decline, closing 2022 at approximately $0.31 (roughly -68% from its January 2022 value of $0.98). By 2025, PNT traded at approximately $0.0005383 with a 24-hour trading volume of $6.25, placing it at rank #7,199 on CoinGecko with a market capitalization of approximately $47,357. The protocol's total value locked and active user base have not been independently verified in available sources at comparable levels to its 2021 peak. The GitHub repository for pnetwork-association shows ongoing but limited maintenance activity.","heading":"Token Performance and Protocol Decline","sources":[{"url":"https://www.coingecko.com/en/coins/pnetwork","name":"coingecko.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/pnetwork","name":"defillama.com","type":"other","credibility":3},{"url":"https://github.com/pnetwork-association","name":"github.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On-chain investigator ZachXBT has flagged pNetwork as a high-risk entity. The specific post or thread underlying the flag has not been independently retrieved and archived in this investigation. ZachXBT's flags typically reflect on-chain evidence of theft, rug activity, or fund misappropriation. Given the two documented security incidents, the disputed pGALA 'white hat' actions, and the active litigation from Gala Games and Huobi, the flag is consistent with documented concerns. A direct link to the original ZachXBT pNetwork post could not be confirmed at the time of this investigation.","heading":"ZachXBT Flag","sources":[{"url":"https://twitter.com/pnetworkdefi/status/1409910381896667136","name":"twitter.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2020-03","event":"pNetwork launches its first cross-chain bridge connecting Bitcoin and Ethereum, enabling pBTC minting.","source":"","date_original":"2020-03-01"},{"date":"2019-05","event":"Provable Things (formerly Oraclize), the company behind pNetwork's technology, merges with Poseidon Group.","source":"","date_original":"2019-05-01"},{"date":"2021-09-19","event":"Attacker exploits event-log validation bug in pBTC-on-BSC bridge, stealing 277 BTC (~$12 million). Other bridges unaffected.","source":""},{"date":"2021-09-20","event":"pNetwork publicly discloses the hack, patches the bug, deactivates all cross-chain bridges, and offers a $1.5 million bounty for return of funds.","source":""},{"date":"2022-08-28","event":"A pNetwork engineer allegedly commits a plaintext private key controlling the pGALA contract's admin and minter roles to a public GitHub repository, creating the vulnerability exploited in November 2022.","source":""},{"date":"2022-11-03","event":"pNetwork mints 55.6 billion pGALA tokens on BNB Chain and dumps them on PancakeSwap, crashing GALA price by 94–97% and draining ~$4.3–4.5 million from the liquidity pool. pNetwork characterizes this as a white hat rescue; Huobi alleges it was a premeditated attack for profit.","source":""},{"date":"2022-11-04","event":"pNetwork issues post-mortem citing a smart contract misconfiguration and defending the white hat action. BlockSec on-chain analysis confirms the leaked private key as root cause.","source":""},{"date":"2023-03-20","event":"Gala Games files a $28 million negligence and tortious interference lawsuit against pNetwork on behalf of pGALA victims, citing over $25 million in out-of-pocket costs.","source":""},{"date":"2023-04-03","event":"Huobi and Gala Games announce a joint $50 million compensation plan for affected users and confirm joint legal action against pNetwork.","source":""},{"date":"2025","event":"PNT token trades at approximately $0.0005, with a market cap of roughly $47,000 and near-zero daily trading volume, representing a decline of over 99.9% from 2021 highs.","source":"","date_original":"2025-01-01"}],"sources_used":[{"url":"https://medium.com/pnetwork/introducing-ptokens-provable-portable-pegged-70911e200933","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.bitget.com/price/pnetwork/what-is","name":"bitget.com","type":"other","archive_url":"https://web.archive.org/web/20260901072236/https://www.bitget.com/price/pnetwork/what-is","credibility":3,"archive_timestamp":"2026-09-01T07:22:36+00:00"},{"url":"https://medium.com/pnetwork/pnetwork-powered-bridges-a-force-to-be-reckoned-with-fb5fb325d257","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.halborn.com/blog/post/explained-the-pnetwork-hack-september-2021","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260322055926/https://www.halborn.com/blog/post/explained-the-pnetwork-hack-september-2021","credibility":3,"archive_timestamp":"2026-03-22T05:59:26+00:00"},{"url":"https://medium.com/pnetwork/pnetwork-post-mortem-pbtc-on-bsc-exploit-170890c58d5f","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cryptoslate.com/12-million-stolen-after-binance-smart-chain-defi-pnetwork-gets-hacked/","name":"cryptoslate.com","type":"other","archive_url":"http://web.archive.org/web/20251110102705/https://cryptoslate.com/12-million-stolen-after-binance-smart-chain-defi-pnetwork-gets-hacked/","credibility":3,"archive_timestamp":"2025-11-10T10:27:05+00:00"},{"url":"https://decrypt.co/81301/defi-bridging-protocol-pnetwork-suffers-12-million-hack","name":"decrypt.co","type":"other","archive_url":"http://web.archive.org/web/20260414161156/https://decrypt.co/81301/defi-bridging-protocol-pnetwork-suffers-12-million-hack","credibility":3,"archive_timestamp":"2026-04-14T16:11:56+00:00"},{"url":"https://www.coindesk.com/business/2021/09/20/cross-chain-protocol-pnetwork-loses-12m-to-hack","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20251115144309/https://www.coindesk.com/business/2021/09/20/cross-chain-protocol-pnetwork-loses-12m-to-hack","credibility":3,"archive_timestamp":"2025-11-15T14:43:09+00:00"},{"url":"https://www.theblock.co/post/118060/defi-pnetwork-hack-wrapped-bitcoin-12-million-lost","name":"theblock.co","type":"other","archive_url":"http://web.archive.org/web/20260725165848/https://www.theblock.co/post/118060/defi-pnetwork-hack-wrapped-bitcoin-12-million-lost","credibility":3,"archive_timestamp":"2026-07-25T16:58:48+00:00"},{"url":"https://www.theblock.co/post/182969/developers-of-pnetwork-bridge-drain-4-3-million-from-pancakeswap-in-white-hat-attack","name":"theblock.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cointelegraph.com/news/report-gala-token-exploit-resulted-from-public-leak-of-private-key-on-github","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20251005101946/https://cointelegraph.com/news/report-gala-token-exploit-resulted-from-public-leak-of-private-key-on-github","credibility":3,"archive_timestamp":"2025-10-05T10:19:46+00:00"},{"url":"https://www.securities.io/huobi-says-pnetwork-hacked-gala-in-a-premeditated-attack-to-make-profits/","name":"securities.io","type":"other","archive_url":"https://web.archive.org/web/20260830133020/https://www.securities.io/huobi-says-pnetwork-hacked-gala-in-a-premeditated-attack-to-make-profits/","credibility":3,"archive_timestamp":"2026-08-30T13:30:20+00:00"},{"url":"https://cryptoslate.com/per-huobi-alleges-pnetwork-made-over-4m-from-its-gala-white-hat-attack/","name":"cryptoslate.com","type":"other","archive_url":"http://web.archive.org/web/20250907054540/https://cryptoslate.com/per-huobi-alleges-pnetwork-made-over-4m-from-its-gala-white-hat-attack/","credibility":3,"archive_timestamp":"2025-09-07T05:45:40+00:00"},{"url":"https://medium.com/pnetwork/lessons-learnt-from-the-pgala-exploit-50e686730b98","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://thedefiant.io/news/defi/pnetwork-misconfiguration-gala-1b-hack","name":"thedefiant.io","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.prnewswire.com/news-releases/gala-sues-pnetwork-on-behalf-of-pgala-victims-301775263.html","name":"prnewswire.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coindesk.com/tech/2023/04/03/huobi-and-gala-games-to-give-50m-to-victims-of-pgala-scheme","name":"coindesk.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://playtoearn.com/news/gala-games-files-28-million-lawsuit-against-pnetwork-over-code-misconfiguration","name":"playtoearn.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cryptorank.io/news/feed/682bd-178077-huobi-and-gala-games-file-lawsuit-pnetwork","name":"cryptorank.io","type":"other","archive_url":"https://web.archive.org/web/20260829192213/https://cryptorank.io/news","credibility":3,"archive_timestamp":"2026-08-29T19:22:13+00:00"},{"url":"https://cryptonews.net/news/gamefi/20692175/","name":"cryptonews.net","type":"other","archive_url":"https://web.archive.org/web/20260830162935/https://cryptonews.net/news/gamefi/20692175/","credibility":3,"archive_timestamp":"2026-08-30T16:29:35+00:00"},{"url":"https://www.coingecko.com/en/coins/pnetwork","name":"coingecko.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://defillama.com/protocol/pnetwork","name":"defillama.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://github.com/pnetwork-association","name":"github.com","type":"other","archive_url":"http://web.archive.org/web/20260302034425/https://github.com/pnetwork-association","credibility":3,"archive_timestamp":"2026-03-02T03:44:25+00:00"},{"url":"https://twitter.com/pnetworkdefi/status/1409910381896667136","name":"twitter.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:53.891211+00:00","updated_at":"2026-09-01T10:06:41.188291+00:00"}}