The Bitcoin-backed stablecoin Yala (YU) lost its peg to the US dollar following a hack, according to a statement from the project team.
Dear Yetis,
We want to keep you informed about a recent security incident at Yala. A breach resulted in the unauthorized transfer of funds; however, the situation is fully contained and under control. We have identified the stolen assets on-chain and are actively working with…
— Yala (@yalaorg) September 14, 2025
On September 13, the price of YU on Uniswap plummeted to $0.3. After several attempts to restore parity with the dollar, the rate at the time of writing stands at $0.65.
Initially, the developers attributed the token’s depeg to an “attempted attack.” They stated that the issue was identified in collaboration with SlowMist experts, and partners took measures to strengthen the protocol’s security. The project assured that users’ assets were not affected.
In a message dated September 14, the team acknowledged the unauthorized withdrawal of funds but did not disclose details. They reiterated that “the situation is fully contained and under control.”
“We have identified the stolen assets on-chain and are actively cooperating with law enforcement to recover them,” the post stated.
Yala guaranteed the full restoration of affected liquidity pools and the ability for users to exchange YU for USDC at a 1:1 ratio.
“On a positive note, all Bitcoin funds remain completely secure, and the Yala protocol continues to generate significant revenue — about $750,000 per month, or $9.17 million annually,” the developers stated.
The Scale of the Problem
According to Lookonchain experts, a hacker unauthorizedly minted 120 million YU in the L2 network Polygon. He then exchanged 7.71 million tokens for 7.7 million USDC on the Ethereum and Solana blockchains.
A hacker minted 120M $YU on Polygon and then sold 7.71M $YU for 7.7M $USDC on Ethereum and Solana via cross-chain.
The hacker still holds 22.29M $YU on Solana and Ethereum, with another 90M $YU still on Polygon that has not been bridged.
The hacker has now exchanged 7.7M $USDC… pic.twitter.com/508QU96DpF
— Lookonchain (@lookonchain) September 14, 2025
In these two networks, the attacker still holds 22.29 million YU, with 90 million coins remaining unbridged on Polygon.
With the 7.7 million USDC obtained, he purchased 1,501 ETH, which he distributed across several wallets.
According to the Yala website, there are 153.3 million “legitimate” YU in circulation. The total value of assets locked in the protocol exceeds $216.6 million.
Meanwhile, DEX Screener shows that liquidity in the YU/USDC pair on Uniswap is only ~$355,000. The decentralized platform is the main market for the Yala stablecoin, accounting for up to 70% of daily trading volume.
Earlier, the DEX Hyperliquid community selected the issuer of its own stablecoin. Native Markets will take on this role.