DeFi’s vulnerability to cross-chain attacks revealed after $3M GAIN theft, triggering a liquidity crunch

Griffin AI’s native token, GAIN, suffered a devastating breach after an unauthorized creation of 5 billion tokens on the Binance Smart Chain (BSC), resulting in a dramatic 84-90% drop in value. Blockchain security company CertiK was the first to detect the attack, which involved generating a fraudulent

Peer on , allowing the perpetrator to circumvent cross-chain verification and issue counterfeit GAIN tokens [ 1 ]. These tokens were quickly exchanged for about $3 million in through and subsequently funneled through Tornado Cash, a privacy-centric mixing service [ 2 ]. On-chain data platforms Lookonchain and EmberCN validated the exploit, monitoring the attacker’s wallets and tracking the movement of the stolen assets [ 3 ].

The breach caused immediate turmoil in the market. GAIN’s price crashed from $0.16 to $0.017 in just one day, wiping out more than $4.6 million in market value [ 4 ]. Daily trading volume soared by 126% to reach $96 million, fueled by panic-driven sales and arbitrage [ 5 ]. The total supply of the token surged from 1 billion to 5.2985 billion, severely diluting existing holders and sparking a liquidity crunch. In response, Griffin AI withdrew its official liquidity pool from the BNB Chain and called on exchanges to halt GAIN trading to limit further damage [ 6 ]. The team also issued a public advisory against using unverified liquidity pools, stressing that the GAIN token on Ethereum was not impacted [ 7 ].

This event revealed significant weaknesses in cross-chain protocols, especially those relying on LayerZero’s peer validation system.

pointed out that the attacker took advantage of a misconfigured LayerZero endpoint, employing similar methods seen in previous incidents like the Yala project exploit [ 8 ]. This highlights the dangers posed by centralized validation mechanisms in decentralized finance (DeFi), where a single vulnerable contract can destabilize entire markets.

Community feedback was divided, with many expressing anger over the lack of responsibility. Some speculated that the breach might have involved an insider or resulted from social engineering, while others called for more rigorous security checks and real-time oversight of cross-chain operations [ 9 ]. Griffin AI’s team has committed to working with exchanges and security experts to recover the stolen assets, though tracking is complicated by the use of Tornado Cash [ 10 ].

The wider DeFi sector has been shaken by this event. According to BNB Chain’s Q2 2025 report, network revenue dropped by 37.5% due to reduced gas fees, but the GAIN exploit underscores ongoing vulnerabilities in fast-growing ecosystems [ 11 ]. Experts caution that such incidents may discourage institutional involvement, especially as BNB Chain vies with Ethereum and

for leadership in DeFi. The breach also brings to light concerns about whether current security measures for cross-chain bridges are sufficient, as these systems are increasingly targeted by advanced attackers.