YU, a Bitcoin-collateralized stablecoin issued by Yala, has failed to fully recover its $1 peg after an attempted exploit on Sunday sent its value plunging to as low as $0.2046.
Yala confirmed the incident in a series of posts on X, saying it “briefly impacted YU’s peg” and that it was working with blockchain security firm SlowMist to investigate. The company stressed that no bitcoin reserves were lost, noting that funds remain “self-custodial or in vaults,” but it suspended its Convert and Bridge features as a precaution.
Yala, which launched YU in early 2024 as a decentralized alternative to dollar-pegged stablecoins, had marketed the token as a safer option because of its direct BTC backing. The project raised seed funding from investors including Dragonfly Capital and received early liquidity support from Polygon Ventures.
Analytics firm Lookonchain reported that the attacker minted roughly 120 million YU on Polygon, then bridged and sold 7.71 million YU for $7.7 million USDC across Ethereum and Solana. The proceeds were later converted into 1,501 ether and spread across multiple wallets. The attacker still holds tens of millions of YU across networks, Lookonchain added.
Blockchain researchers noted similarities to previous “infinite mint” exploits on cross-chain bridge protocols such as Nomad in 2022, which lost $190 million, suggesting vulnerabilities in Yala’s smart contract architecture rather than its Bitcoin reserves.
YU briefly bounced back to $0.917 before sliding again. By late Monday, it was trading around $0.79, according to DEX Screener, well short of its intended $1 peg. Yala did not immediately respond to a request for comment.
Exchanges including Bybit and OKX temporarily disabled deposits and withdrawals of YU, citing “network instability,” further limiting arbitrage opportunities that could have helped restore the peg.
The incident comes as the global stablecoin market edges closer to a $300 billion market cap, according to data from CoinMarketCap, CoinGecko, and DefiLlama. Growth has been driven mainly by Tether’s USDT, Circle’s USDC, and Ethena Labs’ USDe, though industry players acknowledge mainstream adoption remains limited.
YU, backed by overcollateralized bitcoin reserves, has a reported market cap of about $119 million but relatively shallow liquidity — only $340,000 USDC in its Ethereum pool — a factor that likely magnified its price swings during the exploit.
By comparison, USDC’s largest Curve pool holds over $150 million in liquidity, underscoring how smaller projects remain vulnerable to manipulation. Analysts at Kaiko noted that YU’s trading volume spiked 500% during the exploit window, suggesting opportunistic arbitrageurs contributed to volatility.
Regulators are also taking note: the European Union’s MiCA framework, set to take effect in 2025, will require stablecoin issuers to maintain full reserves and meet strict licensing conditions, while the U.S. Congress is still debating a federal stablecoin bill. Japan’s FSA recently approved yen-backed stablecoins, highlighting how global jurisdictions are moving at different speeds in regulating the space.
