Munchables Recovers Millions After Devastating $62.5 Million Exploit

In a recent turn of events in the web3 gaming sphere, Munchables, a popular gaming platform built on the Blast network, faced a significant setback when it fell victim to a massive security breach, resulting in the loss of $62.5 million worth of Ethereum. 

The exploit, which occurred on March 26, sent shockwaves through the cryptocurrency community, raising concerns about the security of decentralized applications (DApps) and the integrity of their platforms.

“Munchables has been compromised,” the platform announced in a social media post, acknowledging the breach and assuring users that it was actively tracking the attacker’s movements. 

Munchables has been compromised. We are tracking movements and attempting to stop the the transactions. We will update as soon as we know more.

— Munchables (@_munchables_) March 26, 2024

The incident shows the vulnerability of decentralized platforms to sophisticated cyber attacks, prompting an urgent investigation into the exploit’s root cause.

According to reports from ZachXBT, a prominent figure in the crypto community known for his investigative prowess, the exploit was traced back to a vulnerability in Munchables’ smart contract system. 

The attacker believed to be a former developer associated with Munchables, exploited this vulnerability to withdraw approximately 17,414 ETH, equivalent to $62.5 million at the time of the incident. 

Munchables had a TVL (Total Value Locked) of $95.62 million about an hour and a half before the platform reported its exploit. A few hours later, Its TVL dropped to around $34.08 million.

“Four different devs hired by the Munchables team and linked to the exploiter are likely all the same person,” ZachXBT revealed, shedding light on the suspicious connections between the developers involved in the exploit.

Four different devs hired by the Munchables team and linked to the exploiter are likely all the same person as they:

>recommended each other for the job
>regularly transferred payments to the same two exchange deposit addresses >funded each others wallets

Github Username… https://t.co/Q0scxp6AxK pic.twitter.com/Pjjo4uKXPE

— ZachXBT (@zachxbt) March 27, 2024

Read Also: HTX Global Recovers from $8 Million Hack, Offers Reward to Hacker

Insider Help And Fund Recovery

The exploit was made possible by manipulating Munchables’ upgradeable proxy contract, as explained by Solidity developer 0xQuit. 

Leveraging their insider knowledge, the attacker modified the Lock contract just before the game’s release, allowing them to assign themselves an artificially high balance of 1 million ETH. 

This unauthorized balance was withdrawn, causing substantial financial damage to the platform and its users.

the Munchables exploit has been planned since deploy.

Munchables is a dangerously upgradeable proxy, and it has been upgraded.

Instead of upgrading from a benign implementation to a malicious one, they did the reverse here

1/🧵

— Quit (@0xQuit) March 26, 2024

However, the story took an unexpected turn when Munchables announced a successful recovery of the stolen funds. In a surprising move, the alleged attacker, identified as one of Munchables’ developers, voluntarily returned the funds, eliminating the need for any ransom demands. 

“The Munchables developer has shared all private keys involved to assist in recovering the user funds,” the Munchables team confirmed, expressing gratitude for the crisis’s resolution without further complications.

In response to the incident, Munchables reassured its users that all funds were safe and initiated a refund process for affected users. 

All user funds are safe, lockdrops will not be enforced, all blast related rewards will be distributed as well. Updates to follow in the coming days. https://t.co/ZukNfTFTWf

— Munchables (@_munchables_) March 27, 2024

The platform allocated a compensatory treasury pool to facilitate the refund process, allowing users to reclaim their deposited funds within a specified timeframe. 

Additionally, the Munchables team expressed gratitude for the crypto community’s support and pledged to enhance the platform’s security measures to prevent future exploits.

While recovering stolen funds represents a positive outcome, it also highlights the importance of swift action and collaboration in addressing security breaches and ensuring hires are ethical and have a single confirmed personality before hiring.

This is what happens when a North Korean dev is hired

— ZachXBT (@zachxbt) March 26, 2024