Gala Games: A Dormant Key Minted $216M of GALA Tokens

At 7.32 in the evening, universal time, on Monday 20 May 2024, an account linked to Gala Games created 5 billion brand-new GALA tokens and started selling them. At the market price that day the new tokens were worth roughly $216 million. Within hours Eric Schiermeyer, Gala's co-founder and chief executive, was on X writing a sentence few crypto bosses ever put in public: "We messed up our internal controls."

The thief sold about 600 million of the new tokens before Gala froze the rest. That raised around 5,913 ether, the currency of the Ethereum blockchain, worth about $22 million. The next morning the same wallet sent all of it back. By the end of the week Gala had its money, 4.4 billion of the stolen tokens were locked in place, and the company was telling the world it had identified the person responsible.

It is one of the few large token thefts that ended with almost nothing lost. The reasons it went wrong, and the reasons it was rescued, are both worth knowing.

Who Gala Games is

Gala Games was founded in 2019 by Schiermeyer, who earlier co-founded Zynga, the company behind FarmVille, and by Wright Thurston. It publishes blockchain games such as Town Star and Spider Tanks, in which items and rewards can be bought, sold and owned by players. Its currency, GALA, is a token, something like a share in the project that trades on exchanges around the clock. In May 2024 the GALA token on Ethereum had a total supply of about 50 billion units.

A token like GALA lives inside a smart contract, a piece of code that moves money by itself according to fixed rules. One of those rules decides who may "mint", meaning create new tokens. Minting is the crypto equivalent of a company issuing new shares, and like a share issue it should be rare, controlled and approved. Gala's contract did limit minting to a short list of authorised accounts. The problem was who was still on that list.

The key nobody was watching

Security firm Hacken, in an analysis cited by the crypto investigations site Rekt, found that the account used in the attack was a "dormant MINTER account" that had not been used for about 180 days. It was a leftover with the power to print money, sitting on the permission list like an old office key that was never collected when a contractor left. Someone obtained the private key, the password that controls the account, and used it.

The thief minted the 5 billion GALA to a new wallet, sent it 2 ether to pay for transaction fees, and began swapping GALA for ether on Uniswap, an automated market where anyone can trade one token for another without a broker, in chunks of up to 100 ether. GALA's price fell about 20% while the selling went on, according to Decrypt, even as the wider market rallied on news that US regulators were warming to exchange-traded funds holding ether.

Gala has never publicly explained how the key escaped. Schiermeyer said the Ethereum contract itself "was never compromised" and that the company had "identified the compromise" and removed the "unauthorized access". Some community members claimed a security contractor had connected to the wallet without protecting their internet connection. Neither Gala nor any investigator has confirmed that.

The off switch that saved it

What turned a $216 million disaster into a $0 one was a feature many crypto purists dislike. A year earlier Gala had upgraded its token contract to a second version that included a blocklist: the power to freeze a specific wallet so its tokens cannot move. It is the same tool a bank uses when it freezes an account suspected of fraud, and critics argue it gives a company too much control over money that is supposed to belong to its holders.

Gala used it. The company said its monitoring system flagged the transfer and that the wallet was blocklisted within 45 minutes. Rekt's reconstruction of the on-chain record put the gap between the first sale and the freeze at about 2 hours and 16 minutes. Either way, 4.4 billion of the 5 billion tokens, nearly 9% of all the GALA in existence, were stuck where the thief had put them. Without the blocklist they would have been dumped on the market, and the price would have collapsed for every holder.

The second rescue was the return. On 21 May, 5,913.2 ether, worth about $22.3 million by Cointelegraph's count, came back from the thief's wallet. That matched the proceeds of the 600 million tokens sold the day before. Gala credited its "swift, effective response and the involvement of Federal law enforcement agencies". Schiermeyer said the company believed it had found the person responsible and was working with the FBI, the US Department of Justice and "a network of international authorities". He did not name anyone.

What happened next

Schiermeyer said Gala would "probably buy and burn" GALA with the returned ether, meaning buy tokens on its own exchange, GalaSwap, and destroy them, much like a company buying back and cancelling its own shares. Gala put the 4.4 billion frozen tokens to a vote of its Founder's Node operators, the people who run the computers behind its network, on whether they should count as burned. Gala also said it would reimburse users who paid unusually high transaction fees during the chaos. DWF Labs, a crypto trading firm, said it bought 28 million GALA on the open market to steady the price.

As of 16 October 2026, no one has been publicly charged over the May 2024 mint, and Gala has not named the person it said it had identified. The outcome of the burn vote was never widely reported. The company has a long history in court: since 2023 Schiermeyer and Thurston have sued each other in Utah, with Schiermeyer alleging that Thurston took 8.6 billion GALA in 2021 and sold them for $130 million, and Thurston accusing Schiermeyer of misusing at least $600 million. Those claims are allegations, and no link between that feud and the 2024 mint has been shown.

The lesson from May 2024 is narrow and expensive to learn elsewhere. Gala had permission controls on its printing press. It simply never cleaned the list. Every account that keeps power after its job is done is a door nobody is watching, and in this case it took a blocklist and a thief willing to give the money back to stop that door from costing $216 million.