Crypto game ‘Munchables’ on Blast exploited for $63M — TradingView News

A nonfungible token (NFT) game called Munchables, built on Ethereum layer-2 blockchain Blast, has suffered a $62 million exploit. 

Munchables announced it had been compromised in a March 26 X post at 9:33 pm UTC and said it was tracking the exploiter’s movements and “attempting to stop the transactions.”

Blockchain analyst ZachXBT responded to the post with the wallet address of the alleged attacker, which currently touts a balance of $62.45 million in Ether ETHUSD, per Blastscan data. 

The wallet address of the exploiter shows that it interacted with the Munchables protocol at 9:26 am UTC, extracting a total of 17,413 ETH, per DeBank data

The exploiter’s wallet address then transferred $10,700 worth of ETH through the Orbiter Bridge, transferring the Blast ETH back into native ETH. At 10:05 pm UTC, the wallet sent an additional 1 ETH to a fresh wallet address. 

ZachXBT claimed the exploit stemmed from the Munchables team hiring a North Korean developer known by the alias “Werewolves0943.” 

In a March 27 X post, Solidity developer 0xQuit claimed that the Munchables attack had been planned from the outset, with one of the developers upgrading the Lock contract — which is meant to lock tokens in for a specified time — with a new implementation shortly before launch. 

“There were appropriate checks to ensure you couldn’t withdraw more than you deposited. But before upgrading, the attacker was able to assign himself a deposited balance of 1,000,000 Ether,” 0xQuit explained.

“[The] scammer used manual manipulation of storage slots to assign himself an enormous Ether balance before changing the contract implementation to one that appears legit. Then he simply withdrew that balance once TVL was juicy enough,” added 0xQuit. 

Munchables is a Blast-based GameFi app revolving around NFT-based creatures. The Munchables protocol allows players to stake Blast ETH and Blast USD (USDB) to farm Blast points and unlock added in-game perks.