A new game built on the Ethereum Layer-2 Blast was exploited for nearly 17k ETH. The NFT game called Munchables has suffered a $62 million exploit. In a March 27 X post, Munchables announced it’d been compromised and said it’s tracking the exploiter’s movements and “attempting to stop the transactions.” Furthermore, they’ve also advised the users not to panic.
How much was compromised?
The alleged attacker’s wallet address has been posted by blockchain analyst ZachXBT, which has a balance of $62.45 million in Ether, according to Blastscan.
Based on DeBank data, the exploiter interacted with the Munchables protocol just a few minutes before they announced the exploit, extracting 17,413 ETH. After that, the exploiter’s wallet address transferred $10,700 worth of ETH through the Orbiter Bridge, converting the Blast ETH back into native ETH.
According to ZachXBT, the exploit came from Munchables hiring a North Korean developer who’s alias is “Werewolves0943.”
It was planned from the start, Solidity developer 0xQuit said in a March 27 X post, with one of the developers upgrading the Lock contract shortly before launch with a new implementation of it. “There were appropriate checks to ensure you couldn’t withdraw more than you deposited. But before upgrading, the attacker was able to assign himself a deposited balance of 1,000,000 Ether,” 0xQuit explained.
“[The] scammer used manual manipulation of storage slots to assign himself an enormous Ether balance before changing the contract implementation to one that appears legit. Then he simply withdrew that balance once TVL was juicy enough,” added 0xQuit.
Munchables proceeds to compensate
In a thread, Munchables further posted advising users not to panic saying, “We’ve allocated a compensatory treasury pool for all users who had ETH Deposited to re-claim their funds.” Via the provided link, users would have to confirm their eligibility to reclaim their funds.
Munchables is a Blast-based GameFi app with NFT-based creatures. The protocol allows players to stake Blast ETH and Blast USD (USDB) for Blast points and rewards.
The Blast team has been urged by X users including pseudonymous metaverse adviser Cygaar to roll back the chain to before the exploit.
A few pushed back against calls for centralized intervention, saying it runs counter to decentralized networks’ ethos – Cinneamhain Ventures’ Adam Cochran argued that it would be “on brand” if Blast intervened.
