Experts believe the Blast-based game\u2019s $63 million hack may have been devised by a North Korean employee. <\/p>\n
Munchables, a prominent web3 game and farm on the Blast Layer 2 network, has suffered a $63 million hack, igniting debate about whether the Blast team should roll back the malicious transaction.<\/p>\n
The incident took place on March 26, with Munchables\u00a0tweeting<\/a>\u00a0that it is actively tracking the flow of funds stolen in the exploit. Two-thirds of Munchables\u2019 total value locked (TVL) was stolen as a result of the incident, with the protocol\u2019s TVL sliding from $96.2 million to $34 million, according to DeFi Llama.<\/p>\n ZachXBT, a popular web3 analyst and sleuth, identified the attacker\u2019s\u00a0wallet<\/a>\u00a0on-chain. The address currently holds 17,412.65 Ether.<\/p>\n 0xQuit, a Solidity auditor,\u00a0said<\/a>\u00a0the protocol\u2019s lock contract was engineered to lay the groundwork for the exploit prior to Munchables\u2019 deployment. <\/p>\n They said the contract was originally unverified and written to allow the attacker to assign themselves a deposited balance of up to 1 million ETH, before being upgraded to a new implementation that concealed the vulnerability.<\/p>\n \u201cIf you never knew about the original implementation, the contract would look just fine\u201d 0xQuit tweeted. \u201c[The] scammer used manual manipulation of storage slots to assign himself an enormous Ether balance before changing the contract implementation to one that appears legit. Then he simply withdrew that balance once TVL was juicy enough.\u201d<\/p>\n ZachXBT\u00a0speculated<\/a>\u00a0that the attack may have been engineered by a North Korean developer hired by the Munchables team.<\/p>\n The incident has given rise to fervent discussions regarding how Blast should next proceed, with Blast possessing the ability to reverse the malicious transaction and exercising control over its bridge to the Ethereum mainnet \u2014 which cannot be bypassed by third-party bridges.<\/p>\n 0xQuit tweeted that third-party Blast bridges appear to have been disabled to protect their operators against potential losses. \u201cMakes sense given the uncertainty,\u201d 0xQuit\u00a0tweeted<\/a>. \u201cIf Blast rolls back\u2026 these bridges are out of pocket on everything they paid out to bridgers, and bridgers would double their money.\u201d<\/p>\n <\/p>\n Start for free<\/a><\/div>\n <\/p>\n DCF God, a popular crypto trader, said rolling back the exploit would not comprise a major departure from Blast\u2019s existing ethos, with the network already exhibiting a centralized architecture.<\/p>\n \u201cDon’t think it’s too crazy for Blast to freeze the underlying ETH from the Munchables exploit,\u201d DCF God\u00a0said<\/a>. \u201cIt’s not like other L2s because they manage the underlying deposits already.\u201d<\/p>\n However, many onlookers warned that reversing transactions would set a poor precedent for the project moving forward.<\/p>\n \u201cTechnically, the Blast team could recover the $62m lost in the Munchables exploit since they control the bridge contract that holds the bridged ETH\/stETH,\u201d\u00a0tweeted<\/a>\u00a00xCygaar, a contributor to Frame. \u201cI don’t think any rollup has done something like this on mainnet yet but the bridge contracts are upgradeable\u2026 It wouldn’t set a good precedent for future exploits\/issues, but it is possible.\u201c<\/p>\n However, many web3 users said they would prefer for Blast to roll back the chain to return assets to victims, despite the risks and centralization concerns associated with such a move.<\/p>\n \u201cBlast can get $62m in stolen ETH back because it controls the bridge to mainnet,\u201d\u00a0tweeted<\/a>\u00a0Beanie, an NFT investor. \u201cThere\u2019s literally no reason for Blast not to act for the benefit of its users.\u201d<\/p>\n Brentsketit, a crypto commentator and investor, said they would feel \u201csafer\u201d engaging with a network that responds to exploits in a centralized manner. \u201cAs anti-crypto as that sounds, but it seems crypto is nowhere close to its root anymore,\u201d they\u00a0tweeted<\/a>.<\/p>\n However, CL207 of eGirl Capital, a Blast investor, said<\/a> they heard that multiple solutions are currently being discussed, and that a roll back may not be needed.<\/p>\n The incident serves as a dampener following Blast\u2019s impressive but controversial\u00a0mainnet launch<\/a>\u00a0four weeks ago.<\/p>\n Blast deployed as the third-largest L2 with a TVL of more than $2 billion owing to accepting deposits to a one-way bridging contract since announcing its launch plans in November. <\/p>\nInside job?<\/h2>\n
Onlookers debate network rollback<\/h2>\n
\n
Exploit pours cold water over Blast<\/h2>\n