Munchables Hacker Restores $62.8 Million in Stolen Ether

A Munchables developer hacked the Ethereum-based NFT game and stole $62.8 million worth of Ether. Within eight hours, the hacker returned the stolen funds without demanding a ransom. Investigators traced the exploit to a North Korean developer hired by Munchables. Blast blockchain creator Pacman will assist in redistributing the recovered funds.

Munchables Hacker Returns $62.8 Million Worth of Stolen Ether

March 27, 2023

In a remarkable turn of events, the hacker responsible for stealing over $62.8 million worth of Ether (ETH) from the Munchables nonfungible token (NFT) game has returned the funds without demanding a ransom.

The hack, which occurred on March 26th at approximately 9:30 pm UTC, drained over 17,400 ETH from the GameFi application. Blockchain investigators PeckShield and ZachXBT immediately began tracking the stolen funds in an attempt to intercept them.

ZachXBT claimed that the exploit originated from the Munchables team's decision to hire a North Korean developer known as "Werewolves0943." The Munchables team has since identified the hacker as one of its former developers.

On March 27th, at 4:40 am UTC, Munchables announced that the hacker had agreed to return the stolen funds after an hour of negotiations. The developer shared all private keys required to recover the user funds, including the keys holding $62,535,441.24 USD, 73 WETH, and the remaining funds.

Pacman, the creator of the Ethereum layer-2 blockchain Blast, on which Munchables is built, expressed gratitude to ZachXBT for his assistance and announced that "the ex-Munchables dev opted to return all funds in the end without any ransom required."

Pacman will collaborate with the Munchables team to redistribute the recovered funds. Victims of the hack are advised to follow communications only from official sources to avoid falling prey to refund scams.

This incident follows another recent hack targeting the decentralized finance (DeFi) aggregator ParaSwap, where hackers stole approximately $24,000 from four different addresses. The protocol has since recovered the funds and begun refunding users.

ParaSwap, with the aid of white hat hackers, resolved the issue and revoked permissions for the vulnerable AugustusV6 smart contract. The protocol disclosed that 386 addresses were affected by the vulnerability, but as of March 25th, 213 addresses had yet to revoke allowances for the flawed contract.