On-chain data suggests an attacker minted 120 million YU and siphoned $7.7 million in USDC.
Yala, the issuer of the Bitcoin-backed stablecoin YU, has suspended some of its product functions after what it described as an “attempted attack” that sent its token plunging from its dollar peg.
The incident, which was brought to the notice of the public on X, left the YU stablecoin under pressure on Sunday after its value dropped as low as $0.2046, before partially recovering.
The team said all user funds remained safe and that Bitcoin deposits on the protocol remained either self-custodial or stored in vaults.
Yala confirmed that the disruption briefly destabilized YU’s peg, prompting the temporary suspension of its Convert and Bridge features. Other services remain unaffected, according to the team.
“We’ve identified issues and, as a precaution, paused some product features. Please wait for our green light before re-engaging,” Yala wrote on X.
“All user assets remain safe. We’re focused on reinforcing stability and making the protocol even more robust,” it wrote in a previous post on X.
The protocol is working with blockchain security firm SlowMist and other partners to investigate the incident and reinforce safeguards. Yala added that a full post-mortem and action plan would be released once the review is complete.
While Yala has described the episode as an “attempted attack”, on-chain data provided by blockchain analytics firm Lookonchain says otherwise, as the exploit looks successful. The attacker was able to mint 120 million YU tokens on Polygon. According to on-chain data, 7.71 million YU was bridged to Ethereum and Solana, where it was exchanged for $7.7 million in USDC.
The funds were subsequently swapped into 1,501 ETH and dispersed across multiple wallets. Lookonchain added that the attacker still controls 22.29 million YU on Ethereum and Solana, while another 90 million YU remains on Polygon, unbridged.
The allegations, if confirmed, would indicate a significant vulnerability in Yala’s cross-chain infrastructure. Yala has so far refrained from confirming any losses, insisting that no user funds were compromised and reiterating that its Bitcoin reserves remain secure.
YU is designed as an over-collateralized Bitcoin-backed stablecoin intended to hold parity with the US dollar. The token, with a market capitalization of roughly $140 million as of the time of writing, trades on decentralized exchanges but has limited liquidity, with just $339,000 in USDC liquidity in its Ethereum pool, according to DEX Screener. It is currently trading around $0.7836 there. Its USDC liquidity pool on Solana is relatively better, trading at $0.9997, with a liquidity pool of $14.9 million.
At its worst, YU dropped below $0.2046 but rebounded to $0.91 before sliding again, and it’s currently priced at $0.9259 according to CoinMarketCap as at the time of writing.
The incident comes amid the rapid expansion of the global stablecoin sector. According to data from CoinMarketCap, the market briefly touched $300 billion this month, driven largely by the dominance of Tether’s USDT, Circle’s USDC, and newer entrants such as Ethena Labs’ USDe making it to the top three list.
For Yala, the challenge now lies in restoring YU’s peg and rebuilding trust among users. It also has to fix the technical flaws that made its platform vulnerable to the exploit.
