Munchables, a rising star in the Web3 gaming world, has been slammed by a brutal $62.5 million exploit. The culprit? It seems it could be someone closer than they thought.

Social Media in Chaos

On March 26th, Munchables confirmed a security breach via social media. Their message was short but stark: "Munchables has been compromised. We are tracking movements and attempting to stop the transactions. We will update as soon as we know more." This sent shockwaves through the gaming community, leaving players worried about their in-game assets.

Crypto Detective Uncovers Potential Insider

ZachXBT, a renowned crypto sleuth, dug into the incident. Blastscan, an Ethereum block explorer, revealed the attacker swiped nearly 17,414 ETH, translating to a staggering $62.5 million loss for Munchables. But here's the jaw-dropper: ZachXBT unearthed evidence suggesting the exploit might be an inside job.

Four Hired Devs, One Alleged Culprit?

ZachXBT identified four developers recently recruited by Munchables who might be the mastermind. Here's why they're suspicious:

Mutual Admiration Society: These devs apparently recommended each other for the job, raising a red flag.

Following the Money: The alleged culprit "regularly transferred payments to the same two exchange deposit addresses" and even "funded each others wallets," hinting at a coordinated effort.

ZachXBT went a step further, publicly revealing the alleged exploiter's GitHub usernames, sending shivers down the Web3 spine.

Upgrade Gone Wrong?

Solidity developer 0xQuit offered a technical perspective on the exploit. It appears the attacker exploited a vulnerability in the game's "Lock contract," designed to secure tokens. Just before launch, a developer suspiciously switched the contract to a new version.

This "dangerously upgradeable proxy" allowed the attacker to manipulate the upgrade and grant themselves a whopping 1 million ETH, paving the way for a massive withdrawal. "The Munchables exploit has been planned since deploy," concluded 0xQuit, highlighting the potential consequences of over-reliance on upgradable contracts.

A Glimmer of Hope?

In a desperate attempt to recover funds, Munchables has pledged to provide all relevant private keys. This includes keys to the stolen $62.5 million, additional holdings, and the remaining game assets. Whether this will lead to a full recovery remains to be seen.

One thing's for sure: Munchables has a long road ahead to rebuild trust with its players and the Web3 community.