PlayDapp, a South Korean NFT and game development platform, has been experiencing a significant exploit since February 9, with losses now reaching $290 million. The exploit was initiated through a private key leak, allowing hackers to mint 200 million of PlayDapp's native PLA tokens, valued at $31 million at the time. The situation escalated on February 12 when an additional 1.59 billion PLA tokens, worth $253.9 million, were minted illicitly. PlayDapp has halted its smart contract for migration and is working with blockchain analytics, security firms, centralized exchanges, and law enforcement to mitigate the damage. The company also offered a $1 million reward for the return of the stolen contracts and assets, and has threatened to contact law enforcement, including the FBI, if the assets are not returned. The total supply of PLA before the hack was only 577 million, making the illicitly minted tokens difficult to sell. The value of PLA has dropped significantly since the exploit began.

PlayDapp announced just before 11:00 am UTC on Feb. 13 that it had halted its smart contract to take a screenshot for migration as the hack of the South Korean Web3 game development platform and nonfungible token (NFT) marketplace continued into the new week. The problem was first noticed on Feb. 9. Blockchain security firm PeckShield noticed an apparent private key leak at PlayDapp after 200 million of its native PlayDapp (PLA) tokens, worth $31 million at the time, were minted. “It seems that deployer’s address has been compromised and attacker’s address is added as a minter,” fellow blockchain security firm Cyvers Alerts explained in Feb. 9 X post. On Feb. 10, PlayDapp posted a message on X addressed to the hacker, offering a reward for the return of the stolen contracts and assets and threatening to contact law enforcement, including the United States Federal Bureau of Investigation, if no response is received. PlayDapp’s customer service was down between Feb. 9 and Feb. 12. According to an Elliptic blog post, the reward offered was $1 million if the contracts and assets were returned by Feb. 13, and otherwise it would offer a bounty of the same amount on the hacker. Wallets associated with the hack were being labeled, Elliptic added. After the deadline passed, PlayDapp said on Medium that it was working with blockchain analytics and security firms, centralized exchanges and law enforcement to counteract the damage from the hack. Related: Hashing It Out: GameFi must improve to drive Web3 adoption Elliptic also said 1.59 billion more PLA, worth $253.9 million at the time, were minted on Feb. 12. The hackers may have trouble selling the illicitly minted tokens, however, since the total supply of PLA before the hack was only 577 million. Happy Lunar New Year #web3  Enter the Year of the dragon with joy and unity Let's set intentions and unlock potential together! May the Lunar New Year bring laughter, abundance, and endless possibilities Wishing you joy and prosperity! $PLA  #crypto  #gamedev  pic.twitter.com/IFHNsvOK9u — PlayDapp (@playdapp_io) February 9, 2024 The value of PLA sank from $0.1823 with $2.83 million in 24-hour trade volume on the morning of Feb. 9 to $0.1482 with $60.17 million in volume at the time of writing. The current value represents a slight rise from a low of $0.1420 earlier in the day, according to CoinMarketCap. PlayDapp introduced the Along with the Gods play-to-earn game on the Polygon blockchain in 2021. That game service was shut down as “unsustainable” in May 2023. NFTs from the game are still available on the PlayDapp website, however. Magazine: Which gaming guild positioned itself best for the bull market? 

PlayDapp Suffers $290M Loss in Exploit Due to Private Key Leak