Munchables
A Web3 game on the Blast network drained of about $62.5M in March 2024 by one of its own developers — an insider whom investigators (ZachXBT) linked to North Korea. After negotiations, the developer returned all of the funds without a ransom.
Also known as: Munchables, Werewolves0493
Summary
Munchables was an NFT-based "GameFi" project on the Ethereum layer-2 network Blast. On March 26, 2024, an attacker drained about 17,400 ETH (~$62.5 million). Within hours, investigators determined the attack came from inside: a developer the project had hired had inserted a backdoor (pre-allocating a huge balance) and upgraded the contract to withdraw funds. [1][2]
Attribution and recovery
On-chain investigator ZachXBT linked the developer (GitHub alias "Werewolves0493," part of a cluster of linked accounts) to North Korea. After negotiations involving the Munchables and Blast teams, the developer returned all of the private keys and funds without demanding any ransom; the assets were moved to a multisig and users were made whole. The episode highlighted the risk of DPRK operatives being hired as crypto developers. [1][2]
Bracketed numbers refer to the numbered sources listed below.
Sources (2)
See also
World Liberty Financial (WLFI) — Justin Sun token freezeProjectsWLFI, a DeFi project linked to Donald Trump and his family, blacklisted/froze the wallet of major investor Justin Sun in Sept 2025 — ~540–595M unlocked WLFI tokens (~$107M) plus ~2.4B locked. Sun sued, alleging an undisclosed admin 'blacklist backdoor'; WLFI denied it and threatened a countersuit. The dispute is ongoing.
Gala Games exploitTokensOn May 20, 2024 an attacker abused a privileged minter account on the GALA token contract to mint 5 billion GALA (≈$200M+ nominal) and dumped ~600M of them for ~$22M of ETH before Gala froze the address. Gala Games called it an internal access-control failure; the attacker later returned the ~$22M.
This page was last updated on Jun 15, 2026. View revision history.
