Crypto game ‘Munchables’ earned $63M on Blast

Munchables, a non-destructive token (NFT) game built on the Ethereum Layer-2 blockchain Blast, has received a $62 million exploit.

Munchables announced in a March 26 X post at 9:33 pm UTC that it had experienced a problem and said it was monitoring the victim's activity and “attempting to stop the transaction.”

Blockchain analyst ZackXBT responded to the article with the wallet address provided by the attacker, which currently has $62.45 million in Ether (ETH), according to Blastscan data.

The exploit's wallet address shows that it interacted with the Munchables protocol at 9:26 am UTC, according to DeBank data, which shows a total withdrawal of 17,413 ETH.

The exploit wallet address transferred $10,700 worth of ETH through the Orbiter Bridge, which transferred the explosive ETH to native ETH. At 10:05 PM UTC, the wallet sent an additional 1 ETH to a new wallet address.

ZackXBT claims the exploit originated from the employment of a North Korean developer named Werewolves0943.

In a March 27 X post, Solidity developer 0xQuit said that the Munchables attack was planned from the beginning, one of the developers modified the lock contract – to lock tokens for a certain period of time – to launch a new application a short time ago.

There were proper checks to make sure you couldn't spend more than you put in. But before the upgrade, the attacker was able to allocate a self-deposited 1,000,000 Ether balance,” 0xQuit explained.

“[The] A fraudster used manual spoofing of storage areas to allocate himself a large Ether balance before making the contract implementation look legitimate. Then, once the TVL is juicy enough, simply leave that balance,” added 0xQuit.

Munchables is an explosion-based GameFi app that revolves around NFT-based creatures. The Munchables protocol allows players to pay Blast ETH and Blast USD (USDB) to earn Blast Points and unlock additional in-game perks.

RELATED: Blast Launches Ethereum L2 Mainnet With $2.3B in Stock Crypto

A number of X users have requested that the hacking team intervene, forcing the chain back before the exploit could take place.

Others pushed back against calls for decentralized intervention against decentralized networks – Adam Cochrane of CinemaHine Ventures argued that the explosion of intervention would be “on brand”.

“It doesn't set a good precedent for future exploits/issues, but it's possible.”

“Invalid state root must be forced by the blast team, which cancels the hacked transaction. To do this, the chain may need to stop completely,” Saigar added.

“While I strongly oppose this move against any other chain, I do not consider Blast to be a ‘heavy decentralized chain' brand, but rather a place of play, experiments, corruption, etc.”

“In that sense, it doesn't seem off-brand for them to intervene to protect the user experience. Optimism is the alignment of the ethos, but the explosion is the integrated social user experience, Saigar added.

Magazine: 5 risks to be aware of when entering Solana memecoins