Cash

Tornado Cash

Tornado

<div class="wp-block-group has-background is-vertical is-layout-flex wp-container-core-group-is-layout-8cf370e7 wp-block-group-is-layout-flex" style="background-color:#abb7c226;font-style:normal;font-weight:200">
 <p><strong>Key Highlights</strong></p>
 <ul>
  <li>GANA Payment was exploited for over $3.1M, first reported by Vlamidir S and actively tracked by investigator ZachXBT.</li>
  <li>Attacker used Tornado Cash on BSC and Ethereum to mix more than $2M in BNB and ETH, obscuring the money trail.</li>
  <li>346 ETH (~$1.05M) remains idle in a known attacker wallet, while the project team has not yet issued any official statement.</li>
 </ul>
</div>
<p>A major exploit has hit GANA Payment, a Binance Smart Chain–based crypto payments project, resulting in more than $3.1 million in losses. The incident came to light when crypto commentator Vlamidir S posted the findings on X, citing details uncovered by well-known blockchain investigator ZachXBT.&nbsp;</p>
<p>Tracking began almost immediately through Zach’s Telegram investigation channel, where suspicious fund movements were <a href="https://t.me/investigations/289" target="_blank" rel="noopener noreferrer nofollow">flagged</a> shortly after the attack occurred. This incident occurred just nine days after the platform’s launch, highlighting vulnerabilities in newly deployed smart contracts.</p>
<h2 class="wp-block-heading" id="what-is-gana-payment">What is GANA payment?</h2>
<p>GANA Payment is a BSC-based Web3 payment project that basically helps people send crypto quickly and lets merchants accept payments easily. While not a major name in the payments industry, it has an active niche user base within the BSC ecosystem.</p>
<h2 class="wp-block-heading" id="how-the-funds-were-moved">How the funds were moved</h2>
<p>According to early findings, the attacker consolidated the stolen assets into a primary address: 0x2e8a8670b734e260cedbc6d5a05532264aae5c38</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>According to <a href="https://twitter.com/zachxbt?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">@zachxbt</a> , the project 'GANA Payment' was exploited a few hours ago for ~$3.1M+ on BSC!<br><br>Theft consolidation<br>0x2e8a8670b734e260cedbc6d5a05532264aae5c38<br><br>The attacker deposited 1140 BNB ($1.04M) to Tornado on BSC and bridged funds to Ethereum where another 346.8 ETH… <a href="https://t.co/lUBy3s3GZW" rel="noopener noreferrer nofollow">pic.twitter.com/lUBy3s3GZW</a></p>— Vladimir S. | Officer's Notes (@officer_secret) <a href="https://twitter.com/officer_secret/status/1991419585686372746?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">November 20, 2025</a>
  </blockquote>
 </div>
</figure>
<p>From the main consolidation wallet, the attacker immediately began moving the stolen funds through laundering channels. The first step was sending 1,140 BNB, worth roughly $1.04 million, into Tornado Cash on Binance Smart Chain.&nbsp;</p>
<p>Tornado Cash is often used in such incidents because it mixes deposits in large pools, making it difficult to trace where the funds originally came from.</p>
<p>After masking the trail on the BSC, the attacker shifted part of the loot to the Ethereum network. Once the assets were bridged there, another 346.8 ETH (around $1.05 million) was deposited into Tornado Cash again, repeating the same mixing strategy.&nbsp;</p>
<p>Using mixers across multiple chains is a common tactic among exploiters, as it breaks the transaction path in several places and makes on-chain tracking far more complicated.</p>
<h2 class="wp-block-heading" id="funds-still-sitting-idle">Funds still sitting idle</h2>
<p>Even after all the mixing, a sizeable portion of the stolen money hasn’t moved at all. Investigators have pointed out that 346 ETH, valued at roughly $1.046 million, is still untouched at the address: 0x7a503e3ab9433ebf13afb4f7f1793c25733b3cca.</p>
<p>Funds sitting idle like this usually suggest the attacker is waiting for the noise to slow down or searching for a new route to move the assets without drawing attention.</p>
<h2 class="wp-block-heading" id="what-the-gana-team-has-said">What the GANA team has said</h2>
<p>In response to the exploit, GANA Payment issued an urgent notice confirming that its interaction contract was compromised, allowing an external attacker to steal assets.&nbsp;</p>
<p>The team stated that both their internal engineers and an independent security firm are now conducting an emergency investigation to understand how the breach occurred, identify weaknesses, and measure the full extent of the damage.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>GANA Urgent Announcement<br><br>GANA’s interaction contract has been targeted by an external attack, resulting in unauthorized asset theft. Our technical team, together with an independent third-party security firm, has initiated an emergency investigation to analyze the attack vector,…</p>— GANA Payment (@GANA_PayFi) <a href="https://twitter.com/GANA_PayFi/status/1991424973190361394?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">November 20, 2025</a>
  </blockquote>
 </div>
</figure>
<p>GANA said it will keep users updated through official channels as the investigation progresses.&nbsp;</p>
<p>To move forward, GANA says it is preparing a full reboot of the project. Part of that process involves compiling a complete list of all user asset addresses and checking the permissions linked to them.</p>
<p>The team added that it will soon share a clear recovery plan with timelines and actionable steps, aiming to protect users and eventually restore all affected assets.</p>
<p>The native $GANA token plummeted over 90% immediately after the news, trading near zero on platforms like GeckoTerminal. Trading volume spiked amid panic selling.</p>
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
 <p>Also Read: <a href="https://www.cryptotimes.io/2025/11/10/hacker-bypasses-sonic-labs-wallet-freeze-moves-21m-s-token/" target="_blank" rel="noopener noreferrer nofollow">Hacker Bypasses Sonic Labs Wallet Freeze, Moves 21M $S Token</a></p>
</blockquote>

GANA Payment Hit by $3.1M Exploit as Hacker Uses Tornado Cash

Table of Contents

The Crypto Times

Other articles published on Nov 20, 2025

Join our free newsletter for daily crypto updates!