This NFT Platform Lost $290M in a 4-Day Exploit

PlayDapp, a South Korean blockchain-based game development platform and non-fungible token (NFT) marketplace, has lost over $290 million in crypto from an exploit lasting four days.

According to a tweet from the platform’s team, the smart contract of PlayDapp’s native token, PLA, has been paused, and preparations are ongoing to conduct a snapshot for migration.

PlayDapp Hacked for $290M

PlayDapp’s woes began on February 9 when an unauthorized wallet minted 200 million PLA tokens worth $36 million at the time. Blockchain security firm PeckShield revealed that the wallet was recently added after the token’s smart contract’s private keys were compromised and the protocol hacked.

In response to the incident, PlayDapp offered the hacker a white hat bounty of $1 million in exchange for the funds to be returned by February 13. The platform threatened to involve law enforcement agencies in multiple jurisdictions in a criminal investigation if the hacker failed to accept the offer.

Surprisingly, the attacker minted another 1.59 billion PLA tokens worth $249.6 million at the asset’s price during the exploit. Without hesitation, the hacker began to launder the stolen funds, swapping and dispersing the assets to different blockchains.

Following the second attack, PlayDapp asked centralized exchanges to suspend deposit and withdrawal transactions for PLA, hindering the hacker’s attempts to move the tokens further. The hacker’s wallets have been frozen, too.

Investigations Ongoing

At press time, the NFT marketplace and gaming platform was investigating the hacker’s intrusion methods, tracking the minted and swapped tokens, and engaging in talks with exchanges for migration solutions like airdrops.

In addition, PlayDapp said blockchain intelligence and security firms and law enforcement agencies are involved in resolving the issue with the protection of PLA holders’ assets being prioritized.

“As a result, assistance from PLA token holders is needed: We request the halt of transactions because we will conduct a migration based on the snapshot shortly. Additionally, we will announce the migration plan soon. Similarly, assistance from DEX operators is also needed: We urge decentralized exchanges to temporarily pause all liquidity pool activities regarding PLA tokens as a precautionary measure,” the PlayDapp team said.

Meanwhile, PLA has lost more than 18% of its value, significantly plunging from $0.182 before the first attack. Data from CoinMarketCap shows the asset is worth $0.148 at writing time.