Munchables

lazarus.day

Munchables suffered a Blast-chain exploit in which linked analysis describes contract manipulation, including a backdoor implementation contract that was later replaced with normal logic to obscure the attacker’s tracks. Reporting discussed possible DPRK IT-worker or North Korea-linked tradecraft as contextual concern, but the linked evidence explicitly notes that North Korean involvement was not confirmed, so no actor attribution is assigned.

tayvano/lazarus-bluenoroff-research

Amt Stolen: $62,000,000

Mendeley Data: Collection of DPRK state-sponsored threat actors' activities v2 (Lyu, Sungkyunkwan Univ.)

Reported: 2024-03; Victims: Munchables; Motivations: FinancialGain; Sectors: Cryptocurrency; Countries: United States

Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025

(MSMT/2025/2, report p. 34-36) “DPRK IT workers are also engaging in cryptocurrency thefts, including thefts in 2024 from Munchables ($62.5 million, ultimately returned) ... On March 26, 2024, according to a private sector partner, DPRK IT workers appeared to exploit the blockchain-based NFT game Munchables on the Blast blockchain, leading to the theft of approximately 17,413.96 ETH, valued at $62.5 million at the time of the attack. Industry sources confirmed that an anonymous insider, a DPRK developer, carried out the exploit. Despite the initial success, the DPRK insider was only able to cash out $6,220 worth of ETH ... The following day, March 27, 2024 ... the hackers returned the funds”. p. 36: “Approximately thirty minutes after the initial theft, the attackers extracted an additional 73.49 ETH”.

The Munchables case is unusual, as probable DPRK IT workers stole and ultimately returned cryptocurrency due to operational impediments they faced in the laundering process.