Galaxy Chain Suffers $3 Million Theft via Reused Failed Transaction Signatures

Galaxy Chain suffered an estimated $3 million (approximately 41 billion won) asset theft. The chain confirmed no evidence of private key theft by the attacker, who instead reused 74 signatures collected from failed transactions up to 55 days prior to extract assets from nine wallets. In a post-incident report published September 14, Galaxy Chain stated that approximately 2 billion GALA and around 37 token types were compromised. The largest single transaction involved 163.98 million GALA being drained in one transfer.

The vulnerability stemmed from how failed transactions were processed and signature verification was implemented. Even though failed transactions remained on the public ledger, their signatures could be reused because the unique key preventing duplicate submissions wasn't consumed. The SDK at the time also incorrectly verified transaction formats based on requested definitions rather than actual executed operations. Attackers exploited this by executing signed data from one operation in another while adding unverified recipient addresses and amounts.

Galaxy Chain revealed that 1,066 transactions were submitted by the attacker on August 18, with a median interval of 4.5 seconds between them. 73.9% were processed exactly at one-block intervals. The first unauthorized transfer occurred on August 18 at 11:21:54 AM KST. Galaxy Chain halted its bridge at 2:09 PM and deployed fixes by 3:27 PM the same day.

The attack used valid signatures, but Galaxy Chain stated no evidence was found that private keys, seed phrases, or passwords of affected wallets were stolen—though this claim is based on internal records not fully disclosed. The incident highlights how even in code reviewed by external security firms like CertiK (November-December 2025) and Hashlock SDK (January 2026), mismatched verification scope versus actual execution can create vulnerabilities.

Post-fix, Galaxy Chain now derives signature formats directly from executed operations. It links signatures to specific operations, channels, and contracts with added expiration times, while ensuring unique keys remain active for failed transactions to prevent reuse attacks. Additional measures include monitoring high-value accounts and rate-limiting requests per identity. For withdrawals exceeding certain thresholds, manual review will be required, though this may cause delays in legitimate transfers or false positives.

As bridges serve as conduits between blockchains for asset movement, withdrawal verification and transaction approval procedures remain key attack points. Galaxy Chain has reported the incident to the FBI Internet Crime Complaint Center and requested platforms freeze assets. Tracking and investigation are ongoing with no recovery figures disclosed. The core issue lies not in private key theft but in how failed transactions' signatures on public ledgers combined with flawed signature verification could be exploited.