Munchables recovers $62.5 million in user funds after exploit linked to North Korean hacker
The platform disclosed that the attacker voluntarily provided all relevant private keys to facilitate the return of user funds. The keys holding the $62.5 million worth of ETH, 73 WETH, and the main owner key were shared.
Pacman, the founder of the layer-2 network, corroborated this development, stating that the hacker returned all stolen funds without demanding any ransom.
Furthermore, Pacman announced that $97 million had been safeguarded in a multisig account controlled by Blast’s core contributors. These funds will soon be redistributed to Munchables and other affected protocols.
He added:
“It’s important that all dev teams, whether directly affected or not, learn from this and take precautions to be more thorough on security.”
The exploit
On March 26, Munchables alerted the crypto community about an exploit on its platform. On-chain investigator ZachXBT promptly identified the address holding the pilfered 17,413 ETH.
According to ZachXBT’s findings, the exploit occurred due to the involvement of a North Korean hacker among Munchables’ core developers.
Further investigation by ZachXBT showed that Munchables had engaged four developers linked to the hacker. Their GitHub usernames were NelsonMurua913, Werewolves0493, BrightDragon0719, and Super1114.
These four accounts likely belonged to a single individual, as they endorsed each other for the job and financially supported each other’s wallets.
Solidity developer 0xQuit said the hacker executed the exploit by creating a backdoor to allocate a balance of 1,000,000 ETH before upgrading the contract implementation. This enabled them to withdraw once the protocol accumulated a significant balance.
North Korean hackers
This incident sheds light on a common tactic employed by North Korean hackers who infiltrate crypto projects as developers and embed backdoors to facilitate future theft.
Ethereum developer Keone Hon referenced an earlier thread outlining signs that a developer might be a North Korean hacker. According to him, these individuals often favor GitHub names such as SupertalentedDev726 or CryptoKnight415, incorporate numbers into their usernames and emails, and use Japanese identities.
He said:
“If you see someone with a cringe bio, a bunch of badges, and a bunch of big repos with only 1 commit (due to squashing the history) just be cautious.”
