TLDR
- Yala’s Bitcoin-backed YU stablecoin crashed from $1 to $0.2046 after an attempted protocol attack on Sunday
- Attacker allegedly minted 120 million YU tokens on Polygon and sold 7.71 million for $7.7 million USDC
- Yala disabled Convert and Bridge features but claims all Bitcoin reserves remain safe in self-custody
- YU recovered briefly to $0.917 but continues trading below peg at around $0.79
- Major exchanges like Bybit and OKX temporarily suspended YU deposits and withdrawals due to network instability
Yala’s Bitcoin-backed stablecoin YU suffered a major price crash on Sunday after what the company described as an “attempted attack” on its protocol. The token fell as low as $0.2046, representing an 80% drop from its intended $1 peg.
The Yala team confirmed the incident in posts on X, stating the attack “briefly impacted YU’s peg.” The company has partnered with blockchain security firm SlowMist to investigate the breach and determine its full scope.
Update: All funds are safe. Bitcoin deposited to Yala remains self-custodial or in vaults, with none lost.
We’ve identified issues and, as a precaution, paused some product features. Please wait for our green light before re-engaging.
A full post-mortem and action plan will…
— Yala (@yalaorg) September 14, 2025
Attack Details and Response
According to blockchain analytics firm Lookonchain, the attacker exploited the Yala protocol by minting approximately 120 million YU tokens on the Polygon network. The attacker then bridged 7.71 million YU tokens and sold them for 7.7 million USDC across Ethereum and Solana networks.
The proceeds were converted into 1,501 Ethereum tokens and distributed across multiple wallets. The attacker still holds 22.29 million YU on Ethereum and Solana, with an additional 90 million YU remaining unbridged on Polygon.
Yala responded by disabling its Convert and Bridge features as a precautionary measure. The company stressed that all Bitcoin deposits remain “self-custodial or in vaults” with no losses to the underlying collateral backing the stablecoin.
Limited Recovery Efforts
YU briefly recovered to $0.917 following the initial crash but has since struggled to maintain stability. As of late Monday, the token was trading around $0.79 on DEX Screener, still well below its target $1 peg.
Exchange Response and Liquidity Issues
Major exchanges including Bybit and OKX temporarily suspended YU deposits and withdrawals, citing “network instability.” These restrictions limited arbitrage opportunities that could have helped restore the token’s peg more quickly.
The incident highlights YU’s liquidity constraints, with only $340,000 in USDC available in its Ethereum pool according to DEX Screener data. Despite reporting a market cap of $119 million, this shallow liquidity likely contributed to the extreme price volatility during the attack.
Trading volume for YU spiked 500% during the exploit window, suggesting opportunistic traders contributed to the price swings. Blockchain researchers noted similarities to previous “infinite mint” exploits on cross-chain protocols, including the 2022 Nomad bridge hack that resulted in $190 million in losses.
The attack appears to have targeted vulnerabilities in Yala’s smart contract architecture rather than its Bitcoin reserves. YU launched in early 2024 as a decentralized alternative to traditional dollar-pegged stablecoins, with backing from investors including Dragonfly Capital and early liquidity support from Polygon Ventures.
