How the Gyroscope project was hacked: a detailed breakdown of the attack and fund flows

On January 30, 2026, the Gyroscope team announced on X that it had temporarily suspended its liquidity pools due to an issue in its cross-chain contract—a mechanism used to transfer assets between different blockchains. As a result of this vulnerability, 6 million Gyro Dollar (GYD) tokens were affected, with the attacker managing to extract liquidity worth approximately $807,000. GetBlock AML Research provides a detailed breakdown of the attack and the movement of the stolen funds.

Source: X.com

The root cause of the incident was an error related to improper input validation in Gyroscope’s bridge contract. This flaw allowed the attacker to grant themselves so-called “unlimited approval” to spend GYD tokens on Ethereum. With this approval in place, the attacker used a standard function that allows transfers on behalf of another contract and drained 6 million GYD tokens.

Following the incident, the Gyroscope team offered the attacker a bounty equal to 33% of the stolen funds in exchange for their voluntary return. This offer was more than three times higher than the industry norm, which typically sits around 10%.

Attack Timeline

Step-by-step sequence of events

The attacker bridged the minimum possible amount—1 wei of GYD (an extremely small fraction of a token)—from the Arbitrum network to Ethereum. As the recipient, they specified not a regular user address, but the GYD token contract itself, while simultaneously passing specially crafted data to be executed.

The 1 wei of GYD was successfully received on Ethereum. At the same time, the attacker obtained unlimited approval to spend GYD tokens. This approval was never revoked.

Using the granted approval, the attacker withdrew 6,099,337.37 GYD tokens.

Vulnerability Explanation

The core issue stemmed from the bridge contract accepting arbitrary input data when calling the BridgeToken() function from contract 0xCA5. This function accepted four parameters: the destination network, the recipient address, the transfer amount, and additional data to be executed after the cross-chain transfer.

The attacker sent 1 wei of Gyro Dollar not to a user address, but directly to the Gyro Dollar token contract—an essential condition for executing the attack. They also included extra data that would be executed after the cross-chain transfer was completed.

On the receiving side, the transfer finalized as expected. However, within the _ccipReceive() function—responsible for handling incoming messages—the contract checked whether additional data had been provided. If so, it automatically executed the corresponding command. In this case, the supplied data triggered the approve() function on the recipient address. Because the recipient was set to the GYD token contract itself, the attacker effectively granted themselves unlimited control over the tokens.

Had the contract restricted the list of allowed recipient addresses or explicitly prohibited using the token contract’s own address, the attack could have been prevented.

Fund Flows

Although the attacker gained control over more than 6 million Gyro Dollar tokens, they were only able to extract around $807,000 in practice. This was due to limited liquidity available in the pools.

Stolen funds being routed through Tornado Cash.

In total, the attacker transferred 300.2 ETH to Tornado Cash, a service commonly used to obfuscate the origin of funds.