March 2024RecoveryNorth Korea

$62M Munchables exploit, fully recovered

The Munchables protocol was exploited for $62M by an embedded DPRK IT worker; within a day, pressure and negotiation produced a full return of funds.

Recovered in full: $62,000,000

Munchables, a game protocol on the Blast network, was drained of $62 million, not by an external hacker but by one of its own developers. The 'developer' turned out to be a DPRK IT worker operating under a false identity, with privileged access baked into the contracts from the start.

Figure 1: Payroll as evidence: the Munchables multisig paid three 'developers', and their wallets forwarded the money to the same exchange deposit addresses.

The attribution surfaced within hours: the developer identity was connected to a cluster of fake personas matching the known pattern of DPRK IT-worker infiltration, several of which appeared to be a single operator. With the exploiter publicly identified and boxed in ($62 million on a young network with thin exit liquidity is hard to launder), negotiation moved quickly.

Table 1: Several 'independent' developer accounts logging in from the same IP addresses. This is the overlap that pointed to a single operator behind multiple personas.

Figure 2: One of the developer identities. The profile's linked contacts and claimed roles matched the pattern seen across other DPRK IT-worker personas.

Within roughly a day, the exploiter handed over the keys and the full $62 million was returned. It remains one of the largest full recoveries in DeFi history, and the clearest demonstration that speed of attribution can change an exploit's outcome entirely.

Timeline

March 26, 2024
Munchables is exploited for $62M via privileged access held by an embedded developer.
March 26, 2024same day
The developer is publicly connected to a cluster of fake identities matching DPRK IT-worker infiltration patterns.
March 27, 2024+1 day
The exploiter relinquishes the keys; all $62M is recovered without any payment.

Source threads

The $62M Munchables exploit: an embedded DPRK IT worker, identified within hours, and a full recovery of funds.

ZachXBT@zachxbtMarch 2024