The Truth About Yala's Suspension: Team Fund Misappropriation and User Losses Being Transferred

Written by: 0xLoki

According to the announcement, hackers stole 7.64 million USDC, the team injected 5.5 million USD of their own funds, and obtained additional liquidity through the Euler platform. Calculating in this way, the additional liquidity obtained through Euler is approximately 2.14 million USD.

Here comes the first doubt: YU is minted by collateralizing YBTC, and obtaining 2.14 million dollars through Euler means that the protocol has collateralized more than 2.14 million dollars worth of YU in Euler, which at least has over 3 million dollars worth of BTC as collateral?

If this 3 million USD in BTC belongs to the YALA team, then why not directly convert the BTC into U, but instead pay high interest rates to borrow from Euler?

There are two situations I can think of: ① The YU used for Euler collateral by YALA does not have sufficient YBTC. ② The BTC corresponding to this part of YBTC is not actually under the control of YALA (for example, some kind of drawer protocol).

The announcement also mentioned that some assets were exchanged for Ethereum before trading resumed, but the subsequent price decline, coupled with the funds invested by the attackers, led to a reduction in the actual recovery value.

Here arises the second point of doubt: based on the price of ETH at 3000 U, the recoverable amount of funds stolen by the hacker is approximately 4.9 million dollars, which means the recovered funds + their own 5.5 million dollars > 7.64 million dollars loss. In this case, why couldn't the project party obtain 2.14 million dollars in financing or bridge loans in other forms? After all, the project party would be solvent after the recovery of the funds.

There are three situations I can think of: ① The project party does not have a recovery plan, and the recovery of funds will prioritize repaying their own funds. ② The project's financing credibility can no longer allow them to obtain additional funds, or losses in other areas far exceed 2.14 million dollars.

Further investigation of the YBTC data reveals that 99% of YBTC is controlled by 3 addresses, which also means that 99% of YU is controlled by these three addresses, temporarily naming them Address A - Address C.

Next, we will analyze the behavior of each address one by one:

Address A: Minted 39.35 million YU, repaid 17 million YU, net liabilities about 22 million YU, address balance 2.4 million YU.

Address B: Minted 43.57 million YU, repaid 10 million YU, net liabilities 33.57 million YU, address balance 2.77 million YU. Most of the YU from Address B (approximately 30.15 million) flowed into contract 0x9593807414, which is Yala's Stability Pool, and the current total deposits shown in the Stability Pool are 32.8 million YU. This means that Address B is also completely normal.

Address C: A total of 32.5 million YU has been minted, 33.3 million YU has been repaid, and YBTC has been destroyed to retrieve BTC. All trading activities are normal.

It is clear that the problem lies with Address A, let's continue to investigate. The transactions of Address A are very complex, but overall, this address net minted 28 million YU and obtained additional YU through other addresses, most of which have already flowed out into various protocols.

From Dabank, we can see other more interesting data. This address has pledged a large amount of YU and PT, borrowing 4.93 million USDT and USDC from Euler. It is clear that these three loans have substantially defaulted after YU fell to 0.15 USD.

This address used a small amount of U to purchase YALA and made a partial repayment to Euler 12 days ago.

Considering that the team mentioned “injecting 5.5 million dollars” and obtained additional liquidity through the Euler platform. This address is very likely the team's operational address, and we now know that the team obtained approximately 4.9 million dollars in liquidity from Euler.

Here is a dividing line; the above are objective data and facts, and the following content is my speculation, which may not be accurate.

(1) YALA obtained about 500 illegal YBTC in some way (which means YALA does not have substantial control over the corresponding 500 BTC) and used these 500 YBTC to mint 28 million YU (let's call it illegal YU for now).

These illegal YU may have been used for other purposes in the past, such as obtaining airdrops, providing DEX liquidity, depositing into Pendle, but that is not important.

I think the reason why these 500 YBTC are illegal is very simple. If you have 50 million dollars worth of BTC at your disposal, you wouldn't take on high-interest loans for a funding need of 7.64 million dollars.

(2) After hackers stole 7.64 million USDC, YALA used a portion of the illegal YU to obtain a loan of approximately 4.9 million dollars from Euler, while also providing some of its own funds in an attempt to get the protocol back on track.

One issue here is that the protocol claims that the $5.5 million in its own funds plus $4.9 million in illegal loans totals more than a $7.64 million funding gap. There are many potential possibilities, such as the $5.5 million figure being inflated or part of the Euler loan being returned to the provider of the $5.5 million.

(3) After the hacker was arrested, due to certain factors, the recoverable funds were far lower than 7.64 million USD, for example, the previously mentioned 4.9 million USD (considering the disposal process, the actual recoverable funds are even lower). In this case, the YALA protocol will still bear a loss of over 2.7 million USD.

In this case, address A chose to default, transferring the losses to Euler, but at the cost of the YALA protocol going bankrupt and ceasing operations.

(4) Who is the mastermind behind this? As mentioned earlier, over 99% of YALA and YU are controlled by three addresses (plus one bfBTC depositor), among which Address B and Address C have no net inflow or outflow of YU, and they are unrelated to the entire matter.

BTC depositors will not incur losses; they only need to repay YU and retrieve their own BTC. The losers are the holders of YU and its derivative assets, as well as the depositors of Euler.

The money flowed to address A, and the ultimate beneficiaries are the YALA team, who shifted the losses onto the users. In fact, if the team pockets the $4.9 million from the judicial disposition, they can still make a profit from it. Of course, all of the above is based on the assumption that address A belongs to the YALA Team.