Hack history / 2025 / Hack or exploit
Yala
Hack or exploit on Sep 14, 2025 · Deployer Key Compromised
SOURCES AGREE ON DATE AND LOSS · 3 SOURCES
Lost
$7.6M
dollars at the time
Returned
none listed
as the sources state it
Rank
#365
among thefts by dollars lost
What happened
During Yala's deployment of its Solana Layer Zero OFT bridge, attackers compromised temporary deployment keys. They used this access to create unauthorized bridge contracts and establish a backdoor for later exploitation. Over a month later, the attacker deployed this infrastructure to mint 120M unauthorized $YU tokens and extract $7.64M in real value. Thai authorities arrested the attacker approximately 45 days after the exploit, and most funds were clawed back.
Details
- Date
- Sep 14, 2025
- Kind
- Hack or exploit
- Method
- Deployer Key Compromised
- How in
- Keys, accounts and infrastructure
- Target
- Token
- Chains
- Solana, Ethereum, Bitcoin
After the theft
- Recovered or seized
- yes, amount not stated
“Thai authorities arrested the attacker approximately 45 days after the exploit, and most funds were clawed back.” (DefiLlama)
Cite this page
SwanBluechip, "Yala hack, Sep 14, 2025: $7.6M lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht95eb9191a4/ (data as of 2026-10-31).