Yala's Bitcoin-backed stablecoin YU depegs after security breach leads to unauthorized mint
Quick Take
- YU, a Bitcoin-backed stablecoin from issuer Yala, depegged following a security breach on Saturday night.
- An attacker minted 120 million YU on the Polygon network without authorization, then bridged the fake stablecoins to other chains to exchange for real assets.
- The Yala team pledged to replenish all drained pools and called the situation “fully contained.”
- Yala’s stablecoin bounced between $0.70 and $0.95 on Sunday, but has not yet held its $1 peg.
We'd love your feedback.
The Bitcoin-backed stablecoin YU, issued by crypto startup Yala, lost its $1 peg after an attacker minted 120 million unauthorized tokens and exchanged the fake stablecoins for real assets.
On Saturday night, the attacker minted 120 million YU on Polygon without providing collateral, then bridged a portion of the stablecoins to Ethereum and Solana, where the attacker exchanged the fake YU for about $7.7 million in USDC stablecoins. Then, the attacker exchanged the USDC for about 1,501 ETH before spreading the funds to multiple addresses, according to blockchain analyst Lookonchain.
"The hacker still holds 22.29M $YU on Solana and Ethereum, with another 90M $YU still on Polygon that has not been bridged," Lookonchain wrote.
The unauthorized minting led YU to depeg from its $1 price target, and the stablecoin has traded between $0.70 and $0.95 on Sunday, according to GeckoTerminal price data, as the Yala team provided updates. YU had a market capitalization of over $150 million before the attack, meaning the 120 million fake YU tokens nearly doubled the token's overall supply.
Yala said on Sunday it would fully replenish the drained liquidity pools and publish a detailed roadmap for recovery efforts within the next 48 hours. "A breach resulted in the unauthorized transfer of funds; however, the situation is fully contained and under control," Yala wrote. "We have identified the stolen assets on-chain and are actively working with law enforcement to pursue recovery."
Yala also said it "identified issues" and paused some product features, though the protocol did not disclose the root vulnerability that led to the attack. The protocol stressed that no Bitcoin was lost as a result of the incident.
Disclaimer: The Block is an independent media outlet that delivers news, research, and data. As of November 2023, Foresight Ventures is a majority investor of The Block. Foresight Ventures invests in other companies in the crypto space. Crypto exchange Bitget is an anchor LP for Foresight Ventures. The Block continues to operate independently to deliver objective, impactful, and timely information about the crypto industry. Here are our current financial disclosures.
© 2026 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.
