PlayDapp Exploit: $290M Loss on Day 4

PlayDapp has suspended its smart contract due to a hack that led to the minting of 200 million PLA tokens worth $31 million.

PlayDapp announced on February 13 just before 11:00 a.m. UTC that it has suspended its smart contract to take screenshots for migration. The hack against the South Korean Web3 game development platform and nonfungible token (NFT) marketplace continued into the new week.

On February 9th, it discovered the issue for the first time. Following the minting of 200 million PLA tokens worth $31 million, the blockchain security company PeckShield discovered what appeared to be a private key breach at PlayDapp.

Another blockchain security company, Cyvers Alerts revealed in a piece published on February 9th on X that the deployer’s address has been hacked and the attacker’s address has been added as a minter. PlayDapp published a statement on X on February 10 directed at the hacker.

The message offered a reward for returning the stolen contracts and assets and it threatened to call law enforcement including the Federal Bureau of Investigation of the United States of America, if the hacker did not respond to the message.

Between February 9th and 12th of February, PlayDapp’s customer assistance was unavailable. Elliptic announced in a blog post that a reward of one million dollars would be offered if the contracts and assets were returned by February 13, failing to return them would subject the hacker to a bounty of the same amount.

Furthermore, Elliptic reported that they were branding wallets connected to the attack. Following the deadline’s expiration of the deadline, PlayDapp stated on Medium that it was collaborating with blockchain analytics and security companies as well as centralized exchanges and law enforcement to mitigate the attack’s impact.

Furthermore on February 12th, Elliptic minted 1.59 billion PLA which was equivalent to $253.9 million at the time. The hackers may face challenges in selling the tokens that were illegally extracted considering that the entire supply of PLA before the attack was only 577 million.

The value of PLA had dropped from $0.1823 with $2.83 million in 24-hour trading volume around the beginning of February 9 to $0.1482 with $60.17 million in volume at the time of this writing. This represents a significant decrease.

According to CoinMarketCap, the current value reflects a modest increase from a low of $0.1420 earlier in the day which was reached earlier in the day. It was in the year 2021 that PlayDapp launched the Along with the Gods play-to-earn game on the Polygon blockchain.

However, non-fungible tokens (NFTs) from the game are still accessible on the PlayDapp website even though the game service was terminated in May 2023 due to its “unsustainable” nature.