Skip to main content
Sign in

Munchables

avoid.net/munchables→10/100·100% conf.
[AI-DRAFTED · AWAITING VERIFICATION][src:defillama]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·W7atPd…uVNS

Summary

Munchables is a Blast-chain NFT game that suffered a $62.5 million exploit on March 26, 2024, when a contractor later attributed to North Korea exploited a backdoor they had embedded in the project's upgradeable smart contracts before launch. The developer surrendered private keys and the full sum was recovered within approximately 24 hours, but the incident exposed fundamental failures in contractor due diligence and smart contract architecture.

Connected Entities

1 entities
Organizations
□Munchables
Relationships
    Have evidence about Munchables?

    Timeline(8 events)

    2022

    A developer later linked to the Munchables exploit was briefly hired by Pixecraft Studios, described as 'sketchy,' and let go within a month.

    21 March 2024

    The Munchables Lock smart contract was upgraded to an unverified implementation address, later identified as part of the attacker's preparation.

    26 March 2024

    The exploit was executed: approximately 17,413 ETH (~$62.5M) was withdrawn by the rogue developer using a pre-planted fraudulent 1,000,000 ETH balance in storage slots.

    26 March 2024

    Munchables announced the breach on X at approximately 9:33 pm UTC and stated it was tracking the exploiter.

    26 March 2024

    ZachXBT identified the attacker's address and four GitHub accounts (NelsonMurua913, Werewolves0493, BrightDragon0719, Super1114) believed to be North Korean-linked.

    26 March 2024

    Within approximately 11 minutes of ZachXBT's public identification, the developer agreed to return all funds and surrendered private keys.

    27 March 2024

    Blast founder Pacman confirmed that the recovered assets had been secured in a multisig controlled by Blast core contributors.

    27 March 2024

    Munchables announced full fund recovery; community rollback proposals for the Blast chain were not pursued.

    Provenance & Audit Trail
    Anchored on SolanaVerify on-chain8 Wayback Archivessrc:defillama

    Decision Log

    This investigation is cryptographically anchored to the Solana blockchain (1 event). 8 of 14 cited source URLs have an Internet Archive snapshot.

    full audit log →version history →

    model: claude-sonnet-4-5

    generated: 5/4/2026, 2:54:33 AM

    last updated: 8/30/2026, 1:16:28 AM

    avoid.net — verified advice for a post-truth world