Gala, formerly known as Gala Games, is a Web3 company that runs its own blockchain, GalaChain. It also publishes games and runs the services around that chain. GALA is its native token. The most recent news comes from autumn 2026. On 14 September 2026 Gala published a post-mortem of a security incident in which about 2.0 billion GALA were taken from nine GalaChain wallets on 18 August 2026. In October 2026 it launched a new version of its decentralised exchange and said it is moving all accounts to Web3-wallet-only sign-in.
What changed in October 2026
Wallet-only access (announced 5 October 2026)
Gala is phasing out email sign-in so that every account is reached through a Web3 wallet. Email login still works while the change is under way. Gala has not given an end date and says it "will announce the retirement timeline in a future update."
To move, users go to Settings → Export to Web3 Wallet in GalaConnect, export their private key and import it into a supported wallet. Gala tells users to back up the key and never share it through email, support tickets, direct messages or screenshots.
New version of Gala's decentralised exchange (live 6 October 2026)
Gala runs its own decentralised exchange on GalaChain. On 6 October 2026 it said V2 was live, with faster performance, better APIs for integrators and updated liquidity-pool software. V2 pools support the same token pairs and fee tiers as V1. The standard 1 GALA transaction fee is waived "for a limited time", with no end date given, though liquidity-pool fees still apply.
Traders do not need to migrate. Liquidity providers have to withdraw from V1 pools and open new positions in the matching V2 pools themselves.
Mirandus: Eternal Night updates (September–October 2026)
Gala's newsroom has posted a run of updates for Mirandus: Eternal Night. The latest, "The Hollow Night" (20 October 2026), adds a seasonal event that runs until 3 November. It includes a boss that several players fight together, crafting with event items and a guided questline for new players. The rewards described are in-game items and currency. The post does not mention GALA payouts.
The 18 August 2026 GalaChain security incident
According to Gala's own post-mortem (published 14 September 2026):
- Scope: nine GalaChain wallets were drained. About 2.0 billion GALA and roughly 37 other tokens left them. The largest single transfer was 1,639,810,337.11548495 GALA.
- Timeline (UTC, 18 August): first unauthorised transfer at 02:21:54. Bridge-outs ran from 02:27 to 04:24. The bridge was paused at 05:09:19, lockdown finished at 06:18:52 and a permanent fix was deployed at 06:27.
- Cause: Gala calls it "signature scope confusion". The signed type declaration travelled with the payload instead of being derived from the operation being called, so a signature could cover different fields from the ones that were executed. The attacker also reused signatures from failed transactions. Gala says the flaw had passed earlier third-party audits.
- Keys: Gala says there is "no evidence that any private key was compromised, ours or any user's." That conclusion rests on internal records Gala has not published, so outsiders cannot check it.
- Response: each payload is now bound to a specific operation and expires, signatures are rate-limited per identity, high-value balances are monitored, and large bridge-outs need manual review. A complaint was filed with the FBI's Internet Crime Complaint Center. The post does not mention reimbursement.
Do Gala's October 2026 changes need action from you?
Answer two questions to see which of Gala's October 2026 changes need you to do something.
How do you sign in to your Gala account in GalaConnect today?
- With email → next question
- With a Web3 wallet → next question
Do you provide liquidity in V1 pools on Gala's decentralised exchange?
- Yes → Two steps: wallet sign-in and liquidity
- No, I only swap or hold → Plan your move to a wallet
Do you provide liquidity in V1 pools on Gala's decentralised exchange?
- Yes → Move your liquidity to V2 yourself
- No, I only swap or hold → No migration step for you
Gala announced on 5 October 2026 that every account will be reached through a Web3 wallet. Email login still works for now and Gala has not given an end date. To move, go to Settings → Export to Web3 Wallet in GalaConnect, export your private key and import it into a supported wallet. Back up the key and never share it through email, support tickets, direct messages or screenshots.
V2 of Gala's decentralised exchange went live on 6 October 2026. Liquidity providers have to withdraw from V1 pools and open new positions in the matching V2 pools themselves. V2 pools support the same token pairs and fee tiers as V1.
Your account will need to move to a Web3 wallet: use Settings → Export to Web3 Wallet in GalaConnect, export your private key, import it into a supported wallet and never share it. Email login still works for now, with no end date given. You also have to withdraw your liquidity from V1 pools and open new positions in the matching V2 pools yourself, since nothing moves automatically.
You already sign in with a wallet, and traders do not need to migrate to V2. The standard 1 GALA transaction fee is waived for a limited time with no end date given, though liquidity-pool fees still apply.
This covers only the wallet-only sign-in change and the V2 liquidity move: it does not list which wallets are supported, give the date email sign-in will be retired (Gala has not announced one), or say anything about whether to hold or trade GALA.
Earlier security events
The 20 May 2024 mint exploit
An attacker gained control of a privileged minter account and minted 5 billion GALA, worth about $240 million at the time (Decrypt). According to the security firm Halborn, that account had been dormant for about six months. About 600 million GALA were sold on a decentralised exchange before Gala blocked the address roughly 45 minutes later, using a blocklist feature added in the 2023 contract upgrade. On 21 May 2024 about 5,913 ETH (roughly $22 million) was returned. CEO Eric Schiermeyer said the roughly 4.4 billion frozen tokens would be "effectively burned", and Gala said a Founder's Node vote would decide whether they count as burned.
The May 2023 token upgrade
Gala moved holders from GALA v1 to a new Ethereum contract, GALA v2, at 1:1, with a distribution scheduled for 15 May 2023. Gala gave the reasons as "enhanced burn mechanisms, security enhancements, and future upgradeability." GALA v1 has no utility now.
What GalaChain and GALA are used for
GalaConnect, Gala's web gateway, describes one interface for bridging, sending, wrapping and managing tokens across GalaChain, Ethereum, Solana and TON. It also handles referrals and node rewards. Other parts of the ecosystem:
- Gala's decentralised exchange for swapping tokens on GalaChain (see above). Swaps carry a standard 1 GALA fee, which is temporarily waived.
- A token launchpad on GalaChain for creating and trading new tokens.
- Gala Playworks (post dated 17 June 2026): an AI tool that turns a written game idea into a playable HTML5 browser game. Creators can test, revise and publish it with leaderboards, wallet sign-in and optional rewards, and "rewards are available only in eligible games and according to the terms shown for each game."
Supply and tokenomics
On 25 October 2026 CoinGecko listed about 50.86 billion GALA in circulation and as total supply, alongside a 50 billion maximum supply, so the circulating figure it reports sits above the stated cap.
What a reader should take from this
- Governance votes are held by Founder's Node operators, not by every GALA holder.
- In two years Gala has had two large incidents, in May 2024 and August 2026, and both involved privileged accounts or signature handling rather than user error. Its own post-mortem says the 2026 flaw had passed outside audits.
- Account access is changing. Users who still sign in with email will need to move to a self-custodied wallet and take responsibility for their private key.
Limitations: the incident details come mainly from Gala's own post-mortem, which relies on internal evidence Gala has not published.
