Munchables, an online game on Ethereum's Blast network, has regained the $62.5 million it lost in a recent attack.

The hacker responsible for the exploit handed over the necessary private keys for returning the funds voluntarily. Keys containing $62.5 million worth of ETH, 73 WETH, and the main owner key were shared.

The founder of Blast network, Pacman, confirmed that the hacker returned all the stolen funds without asking for any ransom.

Additionally, Pacman revealed that $97 million has been secured in a multisig account controlled by Blast's main contributors. These funds will be redistributed to Munchables and other affected platforms soon.

In light of this incident, Pacman emphasized the importance for all developer teams to be more diligent in terms of security, regardless of whether they were directly impacted.

The Attack:

On March 26, Munchables alerted the crypto community about an exploit on its platform. ZachXBT, an on-chain investigator, quickly identified the wallet holding the stolen 17,413 ETH.

According to ZachXBT's investigation, the exploit involved a North Korean hacker who was part of Munchables' development team.

Through further analysis, it was discovered that Munchables had hired four developers associated with the hacker. Their GitHub usernames were NelsonMurua913, Werewolves0493, BrightDragon0719, and Super1114.

These accounts were likely operated by a single individual, as they supported each other financially and vouched for each other's work.

A solidity developer named 0xQuit explained that the hacker exploited a backdoor to allocate 1,000,000 ETH before updating the contract implementation. This allowed them to withdraw funds once a substantial balance had been accumulated.

North Korean Hackers:

This incident highlighted a common strategy utilized by North Korean hackers, infiltrating crypto projects as developers to set up backdoors for future theft.

Developer Keone Hon identified signs of a North Korean hacker, noting that they tend to use GitHub names like SupertalentedDev726 or CryptoKnight415, include numbers in their usernames and emails, and adopt Japanese identities.

He advised exercising caution when encountering developers with vague bios, numerous badges, and large repositories with only one commit, likely due to history squashing.