Why did the Yala (YU) stablecoin lose its peg to USD: analysis of the attack

The exchange rate of the Yala (YU) stablecoin, which is pegged to the US dollar and backed by real bitcoin reserves, fell by 80%. The coin’s value dropped to 0,20 after a hacker attacked the governance protocol. GetBlock AML Research takes a detailed look at the attack on the Yala stablecoin.

The reason for Yala’s instability

The decline in the value of the Yala (YU) coin occurred after a hacker attack on its governance protocol on the Polygon network. The attacker exploited a vulnerability to issue unsecured stablecoins. After the incident, the project developers assured that Yala’s reserves and user funds were safe.

Statement by Yala developers after the protocol hack

Movement of funds

The attacker carried out three phases on different networks to convert the assets.

Phase 1

Initially, an address on the Polygon network was used to issue 120 million OFTU tokens. This address received initial funding from the ChangeNow exchange. Using the LayerZero bridge, 30 million OFTU were converted into 30 million Yala (YU) and sent to the address 87ps8qCum6qaSszbvoARBmFg1Mh1cqcE4ZTAsXfejBMz on the Solana network.

Phase 2

After transferring the assets to the Solana network, the hacker sent part of the coins (17,5 million YU) to another address: 3pPbujCguJzhSakCYundcfjoaXC4JX1aHcDkAukR3J3h. These funds remain untouched to this day.

Next, 2,5 million YU were exchanged for 2,5 million USDC. The stablecoins received as a result of the exchange were transferred to a new Ethereum address: 0x29F48B783EF90F81B51242D9a55e022A214274F5. Two transfers were also recorded: 50 000 USDC to ChangeNow and about 7500 USDC to the KuCoin exchange.

Phase 3

After converting the assets to the Ethereum network, another exchange was made: 5,2 million YU were converted to 5,2 million USDC. Another 7,6 million USDC were exchanged through Wintermute and Uniswap. The stablecoins received were converted into 1635,5 ETH, which were distributed among 161 wallets (10,1 ETH per address). Fifteen addresses have already made ETH transfers to Tornado Cash.

Asset transfer transactions on Tornado Cash. Visualization: MistTrack

At the time of publication, the Yala (YU) stablecoin had almost regained its peg to the US dollar and was trading at $0,97.