120 Million Tokens Out of Thin Air. Yala's "Perfect" Stablecoin That Couldn't Fall... Turned into $7.7M in Losses
How a project with a $119M market cap couldn't withstand a $7.7M attack.
How a project with a $119M market cap couldn't withstand a $7.7M attack.
The Yala protocol suffered a severe blow to its ecosystem: its Bitcoin-backed stablecoin, YU, plummeted by almost 80% on September 14th—from $1 to $0.20—after attackers found a vulnerability in the protocol. The company refers to the incident as an "attempted attack," but the consequences were catastrophic for the token's price.
According to Lookonchain, unknown actors exploited a flaw in the Yala cross-chain bridge, which allowed them to generate approximately 120 million YU on the Polygon network. A portion of these tokens was transferred to Ethereum and Solana, where the hackers swapped 7.71 million tokens for 7.7 million USDC. The funds were then routed through a series of wallets and converted into 1,501 ETH. The attackers still hold 22.29 million YU on Ethereum and Solana, as well as 90 million unclaimed tokens on Polygon.
The developers immediately disabled the Convert and Bridge functions to prevent further manipulation. The company emphasized that all Bitcoin backing the stablecoin remains safe in custody or "self-custody wallets" and was not at risk. Third-party blockchain security experts have been engaged to investigate the incident.
Following the events, YU partially recovered from its drop, climbing to $0.917, but failed to hold that level and is currently trading around $0.79. The main factor behind the instability was limited liquidity reserves: the main poolon Ethereum held only $340,000 USDC, making the price vulnerable to sharp fluctuations on large trading volumes.
(Chart: YU token value over a one-week period - CoinGecko)Major exchanges, including Bybit and OKX, suspended deposits and withdrawals of YU, citing "network instability." This decision essentially stripped traders of the ability to use arbitrage to restore the dollar peg.
The situation was reminiscent of previous infinite mint exploits via bridges—such as the $190 million Nomad Bridge hack in 2022. Vulnerabilities in cross-chain systems remain the weakest point for such projects. Hacker attacks on bridges have become one of the main threats to the DeFi ecosystem.
At the time of the attack, YU trading volumes surged by 500% as some traders tried to capitalize on the extreme volatility. Meanwhile, Yala's Bitcoin reserve remained untouched—the attack targeted the smart contracts. The project launched in early 2024, receiving investments from Dragonfly Capital and support from Polygon Ventures, positioning YU as a more reliable alternative to fiat-backed stablecoins thanks to its direct peg to BTC. Now, its resilience has been called into question.
