GANA Payment exploited for over $3.1 million on BNB Smart Chain: ZachXBT

The GANA Payment project was exploited for more than $3.1 million earlier Wednesday, with the attacker laundering the stolen funds across BNB Smart Chain and Ethereum, according to onchain investigator ZachXBT.

Hackers consolidated the stolen crypto at BSC address “0x2e8…e5c38,” where the bulk of the funds were swapped into BNB. From there, 1,140 BNB — worth roughly $1.04 million — was deposited into Tornado Cash on BSC in an initial attempt to break traceability.

ZachXTB stated that the remaining assets were then bridged to Ethereum, and the exploiter deposited an additional 346.8 ETH, about $1.05 million, into Tornado Cash.

A further 346 ETH, worth approximately $1.046 million, currently sits dormant at the Ethereum address “0x7a5…b3cca,” the onchain sleuth added via his official Telegram channel.

GANA Payment is a small payment token project on BSC built around the BEP-20 GANA token. The project operates primarily through decentralized exchanges and onchain liquidity pools, with limited publicly available technical documentation.

No formal audits or detailed security materials have been published. Details of the underlying vulnerability remain unavailable.

Data from GeckoTerminal shows GANA’s token tumbled by more than 90% following the incident.

GANA token crashes over 90% after $3.1 million exploit | Image: GeckoTerminal

Part of a broader pattern of BSC exploits

The incident adds to a growing list of mid-sized exploits on BNB Chain this year.

According to DefiLlama’s hacks tracker, smaller BSC-based projects have collectively lost over $100 million in 2025.

Several cases, such as the Future Protocol incident, were driven by a stream of contract vulnerabilities, liquidity pool drains, and key compromise attacks.

Today’s GANA Payment exploit follows the same pattern seen across many of those cases — quick draining, consolidation, cross-chain bridging, and mixing — with Tornado Cash frequently serving as the final destination.