GANA Payment Hit by $3.1M Exploit as Hacker Uses Tornado Cash

Key Highlights

• •
  GANA Payment exploited for over $3.1M, first reported by Vlamidir S and actively tracked by investigator ZachXBT.
• •
  Attacker used Tornado Cash on BSC and Ethereum to mix more than $2M in BNB and ETH, obscuring the money trail.
• •
  346 ETH (~$1.05M) remains idle in a known attacker wallet, while the project team has not yet issued any official statement.

A major exploit has hit GANA Payment, a Binance Smart Chain–based crypto payments project, resulting in more than $3.1 million in losses. The incident came to light when crypto commentator Vlamidir S posted the findings on X, citing details uncovered by well-known blockchain investigator ZachXBT.

Tracking began almost immediately through Zach’s Telegram investigation channel, where suspicious fund movements were flagged shortly after the attack occurred.

What is GANA Payment?

GANA Payment is a BSC-based Web3 payment project that basically helps people send crypto quickly and lets merchants accept payments easily. While not a major name in the payments industry, it has an active niche user base within the BSC ecosystem.

How the Attack Was First Detected

The exploit came to public attention when Vlamidir S shared that the project had been drained and that ZachXBT was already monitoring the on-chain activity.

Zach, widely respected for his ability to trace stolen funds across multiple chains, began mapping the attacker’s movements as soon as unusual wallet activity appeared.

How the Funds Were Moved

According to early findings, the attacker consolidated the stolen assets into a primary address: 0x2e8a8670b734e260cedbc6d5a05532264aae5c38

From the main consolidation wallet, the attacker immediately began moving the stolen funds through laundering channels. The first step was sending 1,140 BNB, worth roughly $1.04 million, into Tornado Cash on Binance Smart Chain.

Tornado Cash is often used in such incidents because it mixes deposits in large pools, making it difficult to trace where the funds originally came from.

After masking the trail on the BSC, the attacker shifted part of the loot to the Ethereum network. Once the assets landed there, another 346.8 ETH (around $1.05 million) was pushed through Tornado Cash again, repeating the same mixing strategy.

Using mixers across multiple chains is a common tactic among exploiters, as it breaks the transaction path in several places and makes on-chain tracking far more complicated.

Funds Still Sitting Idle

Even after all the mixing, a sizeable portion of the stolen money hasn’t moved at all. Investigators have pointed out that 346 ETH, valued at roughly $1.046 million, is still untouched at the address: 0x7a503e3ab9433ebf13afb4f7f1793c25733b3cca

Funds sitting idle like this usually suggest the attacker is waiting for the noise to slow down or searching for a new route to move the assets without drawing attention.

What the GANA Team Has Said

In response to the exploit, GANA Payment issued an urgent notice confirming that its interaction contract was compromised, allowing an external attacker to steal assets.

The team stated that both their internal engineers and an independent security firm are now conducting an emergency investigation to understand how the breach occurred, identify weaknesses, and measure the full extent of the damage.

GANA said it will keep users updated through official channels as the investigation progresses.

To move forward, GANA says it is preparing a full reboot of the project. Part of that process involves compiling a complete list of all user asset addresses and checking the permissions linked to them.

The team added that it will soon share a clear recovery plan with timelines and actionable steps, aiming to protect users and eventually restore all affected assets.

Hacker Bypasses Sonic Labs Wallet Freeze, Moves 21M $S Token