The Hire From Hell: How Munchables Lost $62 Million, Then Got It Back

Most crypto hacks start with an outsider finding a weakness. The Munchables exploit of March 2024 started with a job offer going the other way: the project hired a developer, and the developer turned out to be the threat.

On 26 March 2024, about $62.5 million in crypto was drained from Munchables, a game project on Blast, a newly launched Ethereum layer-2 network (a faster, cheaper chain that settles back to Ethereum). Within a day, in one of the most unusual endings in the history of crypto theft, almost all of it, about $60.5 million, came back.

How the backdoor worked

Munchables' smart contract was upgradeable, meaning its code could be replaced after launch. That is a common and often sensible design, because it lets teams fix bugs. But it also means whoever controls the upgrade controls the money.

According to the post-incident analysis, the contract had been upgraded from an implementation whose code was never publicly verified. Before the team later added proper withdrawal checks, the attacker used that hidden code to edit the contract's internal storage and record that his own address had deposited 1,000,000 ETH. He then swapped in a legitimate-looking version of the contract, sat back, and waited for real users to deposit funds. When the pot was large enough, he withdrew the "balance" he had given himself.

A developer who was four people

The attacker was described as a developer the Munchables team had hired. Blockchain investigator ZachXBT linked four supposed developer identities to what appeared to be a single person, based on shared recommendations, shared payment and exchange deposit addresses, and how their wallets had been funded. Crucially, the developer had never handed ownership of the smart contracts back to the team.

There were rumours online of a link to North Korea's Lazarus Group, the hackers behind the 2022 Ronin bridge theft. Those rumours were never confirmed. One studio boss said publicly that they had made a trial hire of the same person in 2022, which ended within a month.

The return

Then came the twist. After the exploit, the developer agreed to share the keys to the funds. About $60.5 million was transferred back to Munchables in three transactions, and core contributors to Blast moved it into a multisig wallet, which needs several people to approve any transaction.

No full explanation for the change of heart was ever made public. But the speed of the on-chain investigation, and the fact that the attacker's identities had been mapped so quickly, almost certainly made the stolen money far harder to use.

By the numbers

• About $62.5 million: the amount drained on 26 March 2024.
• About $60.5 million: the amount returned, in three transactions.
• 1,000,000 ETH: the fake balance the attacker wrote for himself.
• 4: developer identities linked to one person by investigators.
• About $1.24 billion: the total value locked on Blast at the time.

The audit that missed the real risk

Munchables had completed a security audit in March 2024. That did not help, because the danger was not a bug in the code that auditors could spot. It was the person with the keys. An audit checks what a contract does. It cannot tell you whether the developer holding the upgrade rights intends to use them against you.

WGC's take

The Munchables case is a gift to anyone trying to understand blockchain security, because it strips the problem down to its core. The code was not hacked in the movie sense. It did exactly what the person who controlled it told it to do. Players trusted the game; the game trusted its developer; nobody checked that the developer had handed back the keys.

For players, the practical lesson is simple: when a game asks you to deposit crypto, find out who can upgrade the contract that holds it, and whether that power is shared among several people or held by one. "Audited" is good to see. It is not the same as "safe". For a wider look at how these failures fit together, read our editorial on the lessons of blockchain gaming's crashes.