TLDR
- YU stablecoin plunged from $1 to $0.20 after hackers exploited Yala protocol on Sunday
- Attackers minted 120 million YU tokens and sold $7.7 million worth for USDC
- Yala suspended bridge features but claims Bitcoin reserves remain secure
- Token recovered to $0.91 but still trades below dollar peg at $0.79
- Exchanges froze YU trading citing network instability concerns
Yala’s Bitcoin-collateralized YU stablecoin experienced a devastating 80% price crash on Sunday following what the company called an “attempted attack” on its protocol infrastructure. The token dropped to a low of $0.2046 before partially recovering.
The exploit targeted Yala’s cross-chain bridge system, allowing attackers to mint unauthorized tokens. Blockchain security firm SlowMist has been engaged to investigate the full extent of the breach.
How the YU Token Attack Unfolded
According to blockchain analytics platform Lookonchain, hackers exploited the Yala protocol by creating approximately 120 million YU tokens on the Polygon network. They then bridged 7.71 million tokens to Ethereum and Solana, converting them for 7.7 million USDC.
The stolen funds were quickly laundered through multiple wallets after being converted to 1,501 Ethereum tokens. The attackers still control 22.29 million YU on Ethereum and Solana, plus 90 million unbridged tokens on Polygon.
Yala responded by immediately disabling its Convert and Bridge features to prevent further exploitation. The company emphasized that all Bitcoin backing the stablecoin remains “self-custodial or in vaults” with no collateral losses reported.
Market Impact and Exchange Response
The YU stablecoin briefly recovered to $0.917 following the initial crash but has struggled to maintain stability. Current trading data shows YU at approximately $0.79, well below its intended $1 peg.
Major cryptocurrency exchanges including Bybit and OKX temporarily suspended YU deposits and withdrawals, citing “network instability.” These restrictions have limited arbitrage opportunities that could help restore the token’s dollar peg.
The exploit exposed YU’s liquidity constraints, with only $340,000 USDC available in its main Ethereum trading pool. Despite claiming a $119 million market cap, this shallow liquidity pool contributed to extreme price volatility during the attack.
Stablecoin Security Concerns Mount
The YU exploit bears similarities to previous “infinite mint” attacks on cross-chain protocols, including the 2022 Nomad bridge hack that resulted in $190 million losses. These incidents highlight ongoing vulnerabilities in cross-chain bridge technology.
Trading volume for YU spiked 500% during the exploit window as opportunistic traders attempted to profit from the price volatility. The attack appears to have targeted smart contract vulnerabilities rather than Yala’s Bitcoin reserves directly.
YU launched in early 2024 with backing from prominent investors including Dragonfly Capital and received early support from Polygon Ventures. The project positioned itself as a safer alternative to traditional fiat-backed stablecoins through direct Bitcoin collateralization.
