Ethereum

Blast

A nonfungible token (NFT) game called Munchables, built on Ethereum layer-2 blockchain Blast, has suffered a $62-million exploit.&nbsp;
Munchables&nbsp;<a href="https://twitter.com/_munchables_/status/1772739713687752761" target="_blank" rel="noopener nofollow">announced</a>&nbsp;it had been compromised in a March 26 X post at 9:33 pm UTC and said it was tracking the exploiter’s movements and “attempting to stop the transactions.”
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-03/d0ca8711-4b91-4e04-92f1-b294cca278d6.png" alt="" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://twitter.com/_munchables_/status/1772739713687752761" target="_blank" rel="noopener nofollow">Munchables</a>
 </figcaption>
</figure>
Blockchain analyst ZachXBT responded to the post with the wallet address of the alleged attacker, which currently touts a balance of $62.45 million in Ether (<a href="https://cointelegraph.com/ethereum-price">ETH</a>), per Blastscan <a href="https://blastscan.io/tx/0x9a7e4d16ed15b0367b8ad677eaf1db6a2a54663610696d69e1b4aa1a08f55c95" target="_blank" rel="noopener nofollow">data</a>.&nbsp;
The wallet address of the exploiter shows that it interacted with the Munchables protocol at 9:26 am UTC, extracting a total of 17,413 ETH, per DeBank <a href="https://debank.com/profile/0x6e8836f050a315611208a5cd7e228701563d09c5/history" target="_blank" rel="noopener nofollow">data</a>.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-03/16cdcbbc-96ce-4729-adec-00fab0e569b7.png" alt="" title="">
 <figcaption style="text-align: center;">
 The exploiter’s address with over 17,400 ETH incoming from Munchables. Source: DeBank
 </figcaption>
</figure>
The exploiter’s wallet address then transferred $10,700 worth of ETH through the Orbiter Bridge, transferring the Blast ETH back into native ETH. At 10:05 pm UTC, the wallet sent an additional 1 ETH to a fresh wallet <a href="https://debank.com/profile/0x9746d0962f46b175a23e7f7787b061f1417627de" target="_blank" rel="noopener nofollow">address</a>.&nbsp;
ZachXBT claimed the exploit stemmed from the Munchables team hiring a North Korean developer known by the alias “Werewolves0943.”&nbsp;
In a March 27&nbsp;X&nbsp;<a href="https://twitter.com/0xQuit/status/1772764460647846273" target="_blank" rel="noopener nofollow">post</a>, Solidity developer 0xQuit claimed that the Munchables attack had been planned from the outset, with one of the developers upgrading the Lock contract — which is meant to lock tokens in for a specified time — with a new implementation shortly before launch.&nbsp;
“There were appropriate checks to ensure you couldn’t withdraw more than you deposited. But before upgrading, the attacker was able to assign himself a deposited balance of 1,000,000 Ether,” 0xQuit&nbsp;explained.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-03/32ead4c8-ec1b-4f95-b888-933548f8c446.png" alt="" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://twitter.com/0xQuit/status/1772764465555275877" target="_blank" rel="noopener nofollow">0xQuit</a>
 </figcaption>
</figure>
“[The] scammer used manual manipulation of storage slots to assign himself an enormous Ether balance before changing the contract implementation to one that appears legit. Then he simply withdrew that balance once TVL was juicy enough,” added 0xQuit.&nbsp;
Munchables is a Blast-based GameFi app revolving around NFT-based creatures. The Munchables protocol allows players to stake Blast ETH and Blast USD to farm Blast points and unlock added in-game perks.&nbsp;
Related:&nbsp;<a href="https://cointelegraph.com/news/blast-mainnet-launch-unlocks-2-billion-staked-crypto">Blast launches Ethereum L2 mainnet unlocking $2.3B in staked crypto</a>
Several X users, including pseudonymous metaverse adviser Cygaar, have called on the Blast team to intervene by forcibly rolling back the chain to before the exploit occurred.
“An invalid state root would need to be forced by the Blast team which would erase the hacked transaction. The chain might need to halt completely to do this,” added Cygaar.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-03/5c49ab8e-3fd7-4bce-8450-2dbfa7265994.png" alt="" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://twitter.com/0xCygaar/status/1772752423561404480" target="_blank" rel="noopener nofollow">Cygaar</a>
 </figcaption>
</figure>
<blockquote data-ct-non-breakable="true">
 “It wouldn’t set a good precedent for future exploits/issues, but it is possible.”
</blockquote>
Others pushed back against calls for centralized intervention, as it runs against the ethos of decentralized networks — Cinneamhain Ventures partner Adam Cochran <a href="https://twitter.com/adamscochran/status/1772753934941077835" target="_blank" rel="noopener nofollow">argued</a> that it would be “on brand” for Blast to intervene.&nbsp;
“Given that, it doesn’t seem off-brand for them to intervene in defense of user experience. Optimism is ethos alignment, but Blast is gamified social user experience,” Cochran wrote, adding:
<blockquote data-ct-non-breakable="true">
 “While I’m strongly against this action on any other chain, I don’t take Blast as a brand of ‘serious decentralization chain’ but instead as a place for games, experiments, degenry, etc.”
</blockquote>
Magazine:&nbsp;<a href="https://cointelegraph.com/magazine/5-risks-apeing-new-solana-memecoins/">5 dangers to beware when apeing into Solana memecoins</a>

Crypto game Munchables on Blast exploited for $63M

Cointelegraph

Other articles published on Mar 26, 2024

Solana (SOL) Poised to Soar as TVL Tops $4 Billion; Pepe (PEPE) and NuggetRush (NUGX) Tipped as T...

South Korean police catch $4.1M crypto scam duo

Floki Inu ($FLOKI) Price Might See 5x-10x Rally This Bull Run – Here’s Why

Breaking: SEC Asks Judge Torres for Final Judgment in Ripple XRP Lawsuit

New Solana Meme Coin ‘Slothana’ Goes Viral – Is SLOTH The Next SLERF?

Top Altcoins Poised For 10-25X Gains in April

Join our free newsletter for daily crypto updates!