Munchables insider exploit ($62.5M)
Munchables, a game on the Blast network, lost about 17,414 ETH (~$62.5M) on Mar 26, 2024 through contract manipulation. ZachXBT linked the hired developer(s) to a single person assessed as likely North Korean; the funds were later returned.
Also known as: Munchables, Werewolves0493
Summary
Munchables, a game on the Blast network, lost approximately 17,414 ETH (about $62.5 million) on March 26, 2024 when a contract was manipulated to transfer user funds. [1][2]
ZachXBT's findings
ZachXBT reported that four developers hired by the team and linked to the exploiter were likely the same person, citing shared exchange deposit addresses, mutual wallet funding, and cross-recommendations for the role. [1][2] Based on the developer's GitHub activity, ZachXBT assessed them as likely North Korean. [1][2]
Outcome
CoinDesk reported that the developer returned the private keys and the stolen funds were recovered. [1] ZachXBT subsequently acted as a custodian for a multisig holding the recovered funds. [2]
Bracketed numbers refer to the numbered sources listed below.
Sources (2)
See also
World Liberty Financial (WLFI) — Justin Sun token freezeProjectsWLFI, a DeFi project linked to Donald Trump and his family, blacklisted/froze the wallet of major investor Justin Sun in Sept 2025 — ~540–595M unlocked WLFI tokens (~$107M) plus ~2.4B locked. Sun sued, alleging an undisclosed admin 'blacklist backdoor'; WLFI denied it and threatened a countersuit. The dispute is ongoing.
HEX / PulseChain (Richard Heart)ProjectsCrypto projects (HEX, PulseChain, PulseX) created by Richard Heart (Richard Schueler). In July 2023 the U.S. SEC sued him for offering unregistered securities that raised $1B+ and for allegedly misappropriating ~$12M for luxury goods (including a 555-carat diamond). A court dismissed the case in 2024 for lack of U.S. jurisdiction; there was no finding of wrongdoing and Heart denies the allegations.
This page was last updated on Jun 15, 2026. View revision history.
