Web3 Game Munchables Loses $62.5 Million USD

On March 27th, Web3 game Munchables built on layer-2 Blast announced a cyberattack resulting in a significant amount of assets being stolen. According to on-chain detective ZachXBT, the attack has caused Munchables to lose over 17,400 ETH, equivalent to $62.5 million USD.

Exploiter address 17.4K ETH ($62.5M)

0x6e8836f050a315611208a5cd7e228701563d09c5

— ZachXBT (@zachxbt) March 26, 2024

ZachXBT suspects the mastermind behind the hack is a hacker with ties to North Korea – a country previously accused of attacking several major cryptocurrency projects such as Ronin Network, CoinEx, Stake, Atomic Wallet, and Harmony.

In the initial investigation, it was found that the hacker was hired by Munchables, allowing them to infiltrate and modify some lines of code in the smart contract to grant themselves withdrawal permissions.

However, the cryptocurrency community is debating whether Blast will accept reversing the hacked transactions to recover assets for Munchables or not.

The reason being that Blast is in phase 0 and heavily centralized in the development team. The bridge to this layer-2 is a multi-sig address instead of an actual smart contract. The management team could halt the bridge, upgrade the multi-sig wallet contract to disable the hacker’s actions. But this risks exposing Blast’s centralization, going against the decentralized philosophy of blockchain and setting a bad precedent.

Recently, another game project on Blast called Super Sushi Samurai also fell victim to an exploit, losing $4.6 million USD but was later promised reimbursement by a white hat hacker.

Munchables allows players to collect, trade virtual creature NFTs, and stake Blast ETH, Blast USD to earn points.

Related: Blast Releases Mainnet, Expected Airdrop Redemption Schedule

Munchables TVL

Before the hack, the total value locked in the project was $95.62 million USD, but it has now dropped to $34 million USD.