Ethereum

In the late hours of Tuesday, the crypto community saw another exploit. Munchables, the Ethereum Layer-2 NFT gaming platform, reported being compromised on an X post. 
The crypto heist, which momentarily stole over $62 million, took a shocking turn of events after the attacker’s identity opened a Pandora’s box. 
<h2 style="font-weight: 400;" id="crypto-developer-turns-hacker">Crypto Developer Turns Hacker</h2> 
Yesterday, Munchables, a gaming platform powered by Blast, suffered a <a href="https://bitcoinist.com/crypto-gaming-platform-playdapp-hit-double-exploit/" target="_blank" rel="noopener ">security breach</a> that resulted in the theft of 17,400 ETH, worth around $62.5 million. Immediately after the X announcement, crypto detective ZachXBT revealed the sum stolen and the address where the funds had been sent. 
It was later informed that the crypto heist had been an inside job instead of an external one, as one of the project’s developers seemed to be responsible. 
Solidity developer 0xQuit shared on X concerning information about Munchable. The developer pointed out that the smart contract was a “dangerously upgradeable proxy with an unverified implementation contract.” 
<blockquote class="twitter-tweet" data-width="500" data-dnt="true"> 
 the Munchables exploit has been planned since deploy. 
 Munchables is a dangerously upgradeable proxy, and it has been upgraded. 
 Instead of upgrading from a benign implementation to a malicious one, they did the reverse here 
 1/<img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f9f5.png" alt="🧵" class="wp-smiley" style="height: 1em; max-height: 1em;"> 
 — quit.q00t.eth (<img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f440.png" alt="👀" class="wp-smiley" style="height: 1em; max-height: 1em;">,<img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f984.png" alt="🦄" class="wp-smiley" style="height: 1em; max-height: 1em;">) (@0xQuit) <a href="https://twitter.com/0xQuit/status/1772764460647846273?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">March 26, 2024</a>
</blockquote> 
The exploit seemingly wasn’t “nothing complex” as it consisted of asking the contract for the stolen funds. However, it required the attacker to be an authorized party, confirming that the heist was a scheme carried out inside the project. 
After a deep dive into the matter, 0xQuit concluded that the <a href="https://bitcoinist.com/is-your-crypto-safe-trezor-addresses-concerns-over-hack-claims-sophisticated-phishing-scam/" target="_blank" rel="noopener ">attack</a> had been plotted since deployment. Munchable’s developer used the contract’s upgradable nature to “assign himself an enormous ether balance before changing the contract implementation to one that appeared legit.” 
The developer “simply withdrew the balance” when the total value locked (TVL) was high enough. DeFiLlama data shows that, before the exploit, Munchables had a TLV of $96.16 million. At writing time, the TVL has plummeted to $34.05 million. 
As reported by BlockSec, the funds were sent to a multi-sig wallet. The attacker eventually shared all private keys with the Munchables team. The keys gave access to $62.5 million in ETH, 73 WETH, and the owner key, which contained the rest of the project’s funds. According to Solidity developer’s calculations, the total amount neared $100 million. 
<blockquote class="twitter-tweet" data-width="500" data-dnt="true"> 
 The fund is currently in a multisig wallet 0x4D2F75F1cF76C8689b4FDdCF4744A22943c6048C, with the threshold 2/3. Owners are 0xFfE8d74881C29A9942C9D7f7F55aa0d8049C304A, 0xe0C5B8341A0453177F5b0Ec2fcEDc57f6E2112Bc, 0x94103f5554D15F95d9c3A8Fa05A9c79c62eDBD6f <a href="https://t.co/K1YDZo5uvK" rel="nofollow" target="_blank">https://t.co/K1YDZo5uvK</a> 
 — BlockSec (@BlockSecTeam) <a href="https://twitter.com/BlockSecTeam/status/1772869982445051923?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">March 27, 2024</a>
</blockquote> 
<h2 style="font-weight: 400;" id="change-of-heart-or-fear-of-the-crypto-community">Change Of Heart Or Fear Of The Crypto Community?</h2> 
Unfortunately, crypto exploits, hacks, and scams are common in the industry. Most play out similarly, with hackers taking massive sums and investors looking at their empty pockets. 
This time, the incident turned out more thrilling than usual, as the identity of the developer-turned-hacker untangled a web of lies and deception. As ZachXBT suggested, Munchable’s rogue developer was North Korean, seemingly tied to the Lazarus group. 
However, the movie doesn’t end there: the blockchain investigator <a href="https://twitter.com/zachxbt/status/1772845175875772552" target="_blank" rel="noopener nofollow">revealed</a> that four different developers hired by Munchables’ team were linked to the exploiter, and it seemed like they were all the same person. 
<blockquote class="twitter-tweet" data-width="500" data-dnt="true"> 
 the developers <a href="https://t.co/AYMbwduiLS" rel="nofollow" target="_blank">pic.twitter.com/AYMbwduiLS</a> 
 — a1ex (@a1exxxxxxxxxxx) <a href="https://twitter.com/a1exxxxxxxxxxx/status/1772844437674066139?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">March 27, 2024</a>
</blockquote> 
These developers recommended each other for the job and regularly transferred payments to the same two exchange deposit addresses, funding each other wallets. Journalist Laura Shin suggested the possibility of the developers not being the same person but different people working for the same entity, North Korea’s <a href="https://bitcoinist.com/surge-in-north-korean-crypto-attacks-hacks-2023/" target="_blank" rel="noopener ">government</a>. 
Pixelcraft Studios CEO <a href="https://twitter.com/coderdannn/status/1772820871478223074" target="_blank" rel="noopener nofollow">added</a> that he had done a trial hire with this developer in 2022. During the month the ex-Munchables developer worked for them, he exhibited practices “sketchy af.” 
The CEO believes that the North Korean link is possible. Additionally, he revealed that the MO was similar back then, as the developer tried to get “his friend” hired. 
An X user highlighted that the developer’s GitHub name was “grudev325,” pointing out that “gru” could be related to Russia’s Federal Agency for Foreign Military Intelligence. 
Pixelcrafts’s CEO commented that, at the time, the developer explained that the nickname was born after his love for the character Gru from the Despicable Me movies. Ironically, the character in question is a supervillain who spends most of the movie trying to steal the moon. 
<blockquote class="twitter-tweet" data-width="500" data-dnt="true"> 
 didn't even know that was a thing lmeow, this is how he explained it <a href="https://twitter.com/zachxbt?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">@zachxbt</a> <a href="https://t.co/jTMj62GGb2" rel="nofollow" target="_blank">pic.twitter.com/jTMj62GGb2</a> 
 — coderdan.eth | aavegotchi <img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f47b.png" alt="👻" class="wp-smiley" style="height: 1em; max-height: 1em;"><img src="https://s.w.org/images/core/emoji/14.0.0/72x72/1f48a.png" alt="💊" class="wp-smiley" style="height: 1em; max-height: 1em;"> (@coderdannn) <a href="https://twitter.com/coderdannn/status/1772823949791068243?ref_src=twsrc%5Etfw" rel="nofollow noopener" target="_blank">March 27, 2024</a>
</blockquote> 
Whether he was trying to steal the moon and failed like Gru, the developer ultimately returned the funds without asking for “compensation.” Many users believe that the suspicious “change of heart” results from ZackXBT’s deep dive into the attacker’s web of lies and the threats made. 
This thriller ends with the crypto investigator’s reply to a now-deleted post. In his reply, the detective <a href="https://twitter.com/zachxbt/status/1772751157133287603" target="_blank" rel="noopener nofollow">threatened</a> to destroy the developer and all his “other North Korean devs hard on-chain your country has another blackout.” 
<img loading="lazy" decoding="async" class="size-large wp-image-290047 aligncenter" src="https://bitcoinist.com/wp-content/uploads/2024/03/ETHUSDT_2024-03-27_08-31-13.png?w=980&amp;resize=980%2C493" alt="Ethereum, ETH, ETHUSDT, Crypto" width="980" height="493" srcset="https://bitcoinist.com/wp-content/uploads/2024/03/ETHUSDT_2024-03-27_08-31-13.png?w=1022 1022w, https://bitcoinist.com/wp-content/uploads/2024/03/ETHUSDT_2024-03-27_08-31-13.png?w=640 640w, https://bitcoinist.com/wp-content/uploads/2024/03/ETHUSDT_2024-03-27_08-31-13.png?w=768 768w, https://bitcoinist.com/wp-content/uploads/2024/03/ETHUSDT_2024-03-27_08-31-13.png?w=980&amp;resize=980%2C493 980w, https://bitcoinist.com/wp-content/uploads/2024/03/ETHUSDT_2024-03-27_08-31-13.png?w=360 360w, https://bitcoinist.com/wp-content/uploads/2024/03/ETHUSDT_2024-03-27_08-31-13.png?w=750 750w" sizes="(max-width: 980px) 100vw, 980px" data-recalc-dims="1">

Change Of Heart? Gaming Platform Security Breach Ends With $62M In Crypto Returned

Table of Contents

Bitcoinist

Other articles published on Mar 28, 2024

Fetch.ai Token Soars to Record Peak, Sparking Investor Enthusiasm

Nansen Integrates with Chiliz and zkSync for Unrivaled Blockchain Analytics and Insights

BlockDAG Leads the Crypto Market with 5.5 Billion Coins Sold as the Battle of Solana vs Ethereum ...

Ethereum-Based Tokenized Real Estate Platform USP Launches On Republic

Big Day for Bitcoin and Ethereum Tomorrow: $15 Billion BTC and ETH Option Expires! Analyst Warned...

Typhoon Network: The Best Way to Send Private Transactions

Join our free newsletter for daily crypto updates!