ParaSwap

Blast

ZachXBT

Tornado Cash

Tornado

It took nearly eight hours for <a href="https://cointelegraph.com/news/nft-game-munchables-blast-exploited-62-million">the Munchables hacker</a> — a Munchables developer — to have a change of heart and return $62.8 million worth of Ether (<a href="https://cointelegraph.com/ethereum-price">ETH</a>) stolen in an exploit without demanding a ransom.
On March 26, roughly around 9:30 pm UTC, Ethereum-based <a href="https://cointelegraph.com/learn/what-are-nfts-and-why-are-they-revolutionizing-the-art-world">nonfungible token (NFT)</a> game Munchables reported a hack that drained over 17,400 ETH from the GameFi app. 
Munchables, along with blockchain investigators such as PeckShield and ZachXBT, began tracking the movements of the stolen funds in an attempt to intercept them. 
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-03/b14033bf-d706-466c-a84d-be0b8787177b.png" alt="" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://twitter.com/_munchables_/status/1772739713687752761" target="_blank" rel="noopener nofollow">Munchables</a> 
 </figcaption>
</figure>
ZachXBT claimed the exploit stemmed from the Munchables team hiring a North Korean developer known by the alias “Werewolves0943.”&nbsp;
On March 27, 4:40 am UTC, Munchables identified the hacker as one of its developers. An hour of negotiations led the former developer to agree to return the hacked funds. In an official statement, Munchables said:
<blockquote data-ct-non-breakable="true">
 “The Munchables developer has shared all private keys involved to assist in recovering the user funds. Specifically, the key which holds $62,535,441.24 USD, the key which holds 73 WETH, and the owner key which contains the rest of the funds.”
</blockquote>
The creator of the Ethereum layer-2 blockchain Blast, who uses the pseudonym Pacman, thanked ZachXBT for his support, as he announced that “the ex-Munchables dev opted to return all funds in the end without any ransom required.”
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-03/7cfded6a-336d-40f4-a36b-5029d1b9bbc6.png" alt="" title="">
 <figcaption style="text-align: center;">
 Source:&nbsp;<a href="https://twitter.com/PacmanBlur/status/1772871466935013701" target="_blank" rel="noopener nofollow">Pacman&nbsp;</a>
 </figcaption>
</figure>
As Munchables was built on top of the Blast blockchain, Pacman will work with the Munchables team to help redistribute the stolen — now recovered — funds.
In the meantime, victims of the hack are advised to ensure they follow only communications from official sources to avoid falling for refund scams.
Related: <a href="https://cointelegraph.com/news/hacker-moves-10-million-tornado-cash-phishing-incident">Hacker moves $10M from 2023 phishing incident to Tornado Cash</a>
The exploit occurred nearly four days after a hacker stole roughly $24,000 from four different decentralized finance (DeFi) aggregator ParaSwap addresses. The protocol managed to recover the funds and began refunding users.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-03/cffd7671-e02f-49a2-847d-fcd92ea61521.jpg" alt="" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://twitter.com/paraswap/status/1771964824542441528" target="_blank" rel="noopener nofollow"></a><a href="https://twitter.com/paraswap/status/1771964824542441528" target="_blank" rel="noopener nofollow">ParaSwap</a>
 </figcaption>
</figure>
ParaSwap, aided by white hat hackers, successfully resolved the issue and revoked permissions for the vulnerable AugustusV6 smart contract.&nbsp;
In total, ParaSwap revealed that 386 addresses were affected by the vulnerability. However,&nbsp;213 addresses have yet to revoke allowances for the flawed contract as of March 25.
Magazine: <a href="https://cointelegraph.com/magazine/5-risks-apeing-new-solana-memecoins/">5 dangers to beware when apeing into Solana memecoins</a>

Munchables hacker returns $62.8M Ether without ransom

Cointelegraph

Other articles published on Mar 27, 2024

"BloodLoop Levels Up: $4M Raise Fuels Blockchain Gaming Adoption" (27 Mar)

Exploring the Layers and Security of Runes Protocol

Ultimate Low-cap Crypto Guide (April Update)

KuCoin Hemorrhages $780 Million After US Charges It With Violating Anti-Money Laundering Laws

Elon Musk’s Grok AI Unveils “Unhinged Fun Mode”

CFTC Sebut Bitcoin, Ethereum dan Lainnya sebagai Komoditas dalam Gugatan Terbaru

Join our free newsletter for daily crypto updates!