The Munchables Web3 gaming platform based on the second-tier Ethereum solution Blast lost $97 million as a result of an exploit. The hacker returned the funds without any conditions.
$97m has been secured in a multisig by Blast core contributors. Took an incredible lift in the background but I’m grateful the ex munchables dev opted to return all funds in the end without any ransom required. @_munchables_ and protocols integrating with it like @juice_finance…
— Pacman | Blur + Blast (@PacmanBlur) March 27, 2024On March 26, the team reported the incident. Munchables said it is monitoring the movement of funds and trying to stop transactions.
The well-known on-chain researcher ZachXBT indicated the hacker’s wallet, which contained 17,400 ETH ($62.5 million). The expert suggested that the attacker is a North Korean developer hired by the project. In this case, the programmer introduces himself as four different persons.
Four different devs hired by the Munchables team and linked to the exploiter are likely all the same person as they:
>recommended each other for the job
>regularly transferred payments to the same two exchange deposit addresses >funded each others wallets
Github Username… https:// t.co/Q0scxp6AxK pic.twitter.com/Pjjo4uKXPE
March 27, the Munchables team reported that the developer agreed to return access to all withdrawn funds. According to the statement, he provided private keys to addresses that contained $62.5 million, 73 WETH and other assets.
The Munchables developer has shared all private keys involved to assist in recovering the user funds. Specifically, the key which holds $62,535,441.24 USD, the key which holds 73 WETH, and the owner key which contains the rest of the funds.
— Munchables (@_munchables_) March 27, 2024According to the founder of the NFT marketplace Blur and the Blast project under the pseudonym Pacman, the network developers received all the coins with a total value of $97 million in a multi-signature wallet. The hacker allegedly returned them without any reward.
“It is important that all development teams, whether they are directly affected or not, learn from this and take precautions to be more careful about security issues,” the entrepreneur emphasized.
Recall that the first rug pull in Blast occurred even before the launch of the mainnet - the founders of the gaming platform RiskOnBlast withdrew 420 ETH ($1.25 million at that time).