Sign in Subscribe
Vulnerabilities

Griffin AI’s $3M Token Heist: How Admin Keys Turned Their Bridge Into a Money Printer

Griffin AI’s $3M Token Heist: How Admin Keys Turned Their Bridge Into a Money Printer

Source: Griffin AI REKT

Griffin AI’s recent launch on Binance Alpha ended in disaster after an attacker exploited LayerZero’s cross-chain protocol to mint 5 billion unauthorized $GAIN tokens-five times the original 1 billion max supply. This led to a hyperinflation event that wiped out more than 90% of $GAIN’s value in hours.

What Happened?

  • The attacker tricked LayerZero into treating a fake Ethereum token contract as trusted peer, allowing them to mint an enormous amount of $GAIN tokens on BNB Chain.
  • This malicious contract impersonated Griffin AI’s real Ethereum contract, fooling the cross-chain bridge with forged messages.
  • About 147.5 million $GAIN tokens were dumped immediately for 2,955 BNB, converted into 720 ETH, with 700 ETH sent to Tornado Cash for laundering.
  • The remaining 4.85 billion fake tokens remain in the attacker’s wallet, a lingering threat to the token’s market.

Griffin AI’s Response and Admission

  • Initial reaction was slow and understated – 22 minutes after GoPlus Security raised the alarm, Griffin AI issued a basic investigation notice with no firm details.
  • Founder Oliver Feldmeier later took full responsibility, confirming the breach originated from a compromised LayerZero admin key that allowed the attacker to register a fake peer contract.
  • The team restored token balances based on pre-hack snapshots but essentially admitted the tokenomics were broken beyond repair.

Why Did This Happen?

  • The root cause was an admin key leak or phishing that gave control to an attacker who could manipulate LayerZero’s “peer” system, which decides which contracts on other chains to trust.
  • LayerZero’s architecture allowed the attacker to bypass validation, mint tokens freely, and bridge fake assets as if they were legitimate.
  • This mirrors previous exploits affecting Seedify and Yala projects, highlighting a recurring vulnerability in LayerZero’s peer trust model.

Security Implications

  • The exploit demonstrates the danger of admin keys falling into wrong hands, converting bridges into “money printers.”
  • It raises critical questions about cross-chain security and the ability of protocols to detect fake peers before catastrophic damage.
  • Griffin AI’s crisis management was overshadowed by faster moves from blockchain forensic teams who traced the attacker’s movements before the team even publicly acknowledged the hack.

Aftermath and Market Impact

  • Official $GAIN liquidity pools were rapidly withdrawn from BNB Chain to stop further damage.
  • Users were warned to avoid any liquidity pools created by the attacker, as fake $GAIN tokens still circulate on DEXs.
  • Within hours, $GAIN’s price collapsed over 90%, freezing expansion plans and shaking community trust.

The Takeaway

  • Administrative access remains the biggest security risk for Web3 projects, often more than the code itself.
  • Cross-chain bridges must strengthen trust models to avoid accepting false peer contracts.
  • Griffin AI’s story is a cautionary tale demonstrating that without tight key management and robust peer validation, even sophisticated tokenomics can be instantly invalidated.

Read next