Munchables, a nonfungible token (NFT) game built on the Ethereum layer-2 blockchain Blast, has fallen victim to an exploit worth $62 million. The incident was announced in a post on March 26 at 9:33 pm UTC, where Munchables stated that it was monitoring the exploiter’s actions and attempting to halt the transactions.
Blockchain analyst ZachXBT responded to the post by sharing the wallet address of the alleged attacker, which currently holds a balance of $62.45 million in Ether (ETH) according to Blastscan data.
Further analysis of the exploiter’s wallet address revealed that it interacted with the Munchables protocol at 9:26 am UTC and withdrew a total of 17,413 ETH, as per DeBank data.
Following this, the exploiter transferred $10,700 worth of ETH through the Orbiter Bridge, converting the Blast ETH back into native ETH. At 10:05 pm UTC, the wallet sent an additional 1 ETH to a newly created wallet address.
ZachXBT claimed that the exploit was a result of Munchables hiring a North Korean developer known as “Werewolves0943.” Solidity developer 0xQuit supported this claim in a post on March 27, stating that the attack had been premeditated. According to 0xQuit, one of the developers upgraded the Lock contract, which is responsible for locking tokens for a specific period, shortly before the launch. This allowed the attacker to assign themselves a balance of 1,000,000 Ether before the upgrade, despite there being checks in place to prevent such actions.
In response to the incident, some users, including metaverse adviser Cygaar, urged the Blast team to intervene by rolling back the chain to a state before the exploit took place. However, others argued against centralized intervention, as it goes against the decentralized nature of networks. Adam Cochran, a partner at Cinneamhain Ventures, suggested that Blast’s intervention would be in line with their gamified social user experience.
Munchables is a GameFi app on the Blast platform that revolves around NFT-based creatures. Players can stake Blast ETH and Blast USD to earn Blast points and unlock additional in-game perks.
Note: The article has been completely rewritten while retaining the general semantics and accuracy of the original content.