{"investigation":{"slug":"playdapp","entity_name":"PlayDapp","trust_score":53,"severity_base":53,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"PlayDapp is a South Korean blockchain gaming platform and NFT marketplace founded in 2017 and operating on Ethereum and Polygon. In February 2024, an attacker who had obtained PlayDapp's contract deployer private key via a phishing email added themselves as an authorized minter and minted 1.79 billion PLA tokens across two events, representing a nominal loss of approximately $290 million. The platform subsequently suspended the PLA smart contract and executed a 1:1 migration to a new token (PDA) to remediate the illegitimate token supply.","sections":[{"content":"PlayDapp was established in 2017 and is headquartered in Gangnam-gu, Seoul, South Korea. The platform is operated by SuperTree, which was selected as part of Samsung Electronics' C-Lab Outside program in 2019. Leadership includes Brian Choi (CEO), Moshua Choi (Head of Strategy), Ozzy Koh (Head of Technology), and Sang Chung (Head of Business). PlayDapp operates a blockchain gaming ecosystem and NFT marketplace on Ethereum and Polygon, enabling players to participate in games and trade in-game items as NFTs. Its first titles, CryptoDozer and DozerBird, launched in 2019; CryptoDozer briefly surpassed CryptoKitties in daily transaction volume. The PLA token is an ERC-20 token with a designed total supply of 700 million, listed on Coinbase, MEXC, Uniswap, and QuickSwap. PlayDapp secured $2.5 million in seed funding. In early January 2024, PLA traded at approximately $0.22 with a market capitalization of roughly $124 million.","heading":"Platform Background","sources":[{"url":"https://iq.wiki/wiki/playdapp","name":"PlayDapp — IQ.wiki","type":"research","credibility":2},{"url":"https://www.prnewswire.com/news-releases/playdapp-and-itsbs-gamepot-join-forces-to-introduce-blockchain-games-to-north-america-301422926.html","name":"PlayDapp and ITSB GamePot press release — PR Newswire","type":"official","credibility":2},{"url":"https://theenterpriseleader.com/2024/01/01/playdapp-price-reaches-0-22-on-exchanges-pla.html","name":"PlayDapp Price Reaches $0.22 on Exchanges — Enterprise Leader","type":"news_article","credibility":3}],"severity":"low"},{"content":"On January 16, 2024, at approximately 11:13 AM (UTC+9), a member of PlayDapp's team received a domain-spoofed phishing email crafted to appear identical to legitimate communications from a major exchange partner — matching sender address, subject line, and body content. Upon opening the email attachment, malicious code executed and installed a tampered remote-access tool, granting the attacker control over the system. Through this foothold, the attacker exfiltrated the private key corresponding to PlayDapp's contract deployer address. On February 9, 2024, at 10:39 PM (UTC+9), the attacker used the compromised deployer key to call the contract's access control function, adding their own wallet as an authorized PLA minter. The attacker immediately minted 200 million PLA tokens, valued at approximately $36.5 million at prevailing prices. PlayDapp detected the incident on February 10 and broadcast an on-chain message to the attacker on February 11, offering a $1 million white-hat bounty in exchange for return of contract access and all stolen funds by February 13, 2024, at 3:00 AM ET. The attacker did not respond to the offer, and negotiations broke down by February 12, 3:35 PM. Blockchain security firm PeckShield confirmed the attack vector as a private key leak, and Elliptic noted funds had begun moving to multiple accounts almost immediately.","heading":"The February 2024 Private Key Compromise","sources":[{"url":"https://playdapp.medium.com/playdapp-post-mortem-on-the-hacking-incident-361b4ddfb5a1","name":"PlayDapp Post-Mortem on the Hacking Incident — PlayDapp Team (Medium)","type":"official","credibility":1},{"url":"https://www.bleepingcomputer.com/news/security/hackers-mint-179-billion-crypto-tokens-from-playdapp-gaming-platform/","name":"Hackers Mint 1.79 Billion Crypto Tokens from PlayDapp Gaming Platform — BleepingComputer","type":"news_article","credibility":2},{"url":"https://www.elliptic.co/blog/crypto-gaming-platform-playdapp-suffers-290-million-breach","name":"Crypto Gaming Platform PlayDapp Suffers $290 Million Breach — Elliptic","type":"research","credibility":2},{"url":"https://www.halborn.com/blog/post/explained-the-playdapp-hack-february-2024","name":"Explained: The PlayDapp Hack (February 2024) — Halborn","type":"research","credibility":2}],"severity":"critical"},{"content":"After negotiations failed on February 12, 2024, at 10:09 PM (UTC+9), the attacker minted an additional 1.59 billion PLA tokens, valued at approximately $253.9 million at the time of minting. The combined total of 1.79 billion illegitimately minted tokens dwarfed the 577 million PLA tokens that had been in legitimate circulation prior to the attack, representing roughly 72 percent of the original total minted supply and inflating the token supply by more than three-fold. The combined nominal value of both minting events reached approximately $290.4 million, placing the incident among the largest single crypto asset thefts to that date. The attacker's wallet addresses identified by security researchers include 0xD151050d43c28690766f50Ce9ea8686c5D243a40, 0x1cae9eAa76E880fe47A26dd838E5Ec056C289155, 0xe84d086f2c402d297d05b1bccc06d0e0942ec03c, and 0x23cAeE3666b553445e430D1635AD64fBF388B07d. Due to the massive token supply inflation, the attacker was only able to liquidate an estimated $32 million worth of PLA before exchange precautions halted further conversion. Approximately 163 million tokens were attempted to be deposited at exchanges but were largely frozen.","heading":"Second Minting Event and Full Scope of Losses","sources":[{"url":"https://playdapp.medium.com/playdapp-post-mortem-on-the-hacking-incident-361b4ddfb5a1","name":"PlayDapp Post-Mortem on the Hacking Incident — PlayDapp Team (Medium)","type":"official","credibility":1},{"url":"https://medium.com/nefture/playdapp-exploit-post-mortem-of-a-290m-heist-f6803349cde8","name":"PlayDapp Exploit Post-Mortem of a $290M Heist — Nefture Security (Medium)","type":"research","credibility":2},{"url":"https://cointelegraph.com/news/playdapp-exploit-continues-4th-day-losses-reaching-290-million","name":"PlayDapp Exploit Continues 4th Day, Losses Reaching $290M — CoinTelegraph","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/277334/crypto-gaming-platform-playdapp-loses-290-million-worth-of-tokens-in-two-exploits-elliptic","name":"Crypto Gaming Platform PlayDapp Loses $290 Million — The Block","type":"news_article","credibility":1}],"severity":"critical"},{"content":"No official attribution to a named threat actor has been issued by PlayDapp, South Korean law enforcement, the FBI, or any government agency as of the time of this investigation. Several security researchers and media outlets have noted that the attack's characteristics are consistent with tactics associated with the North Korean state-sponsored hacking collective known as the Lazarus Group. These alleged similarities include: the use of a sophisticated spear-phishing email to obtain private key material from an insider, rapid dispersal of stolen assets across multiple externally-owned accounts (EOAs), cross-chain bridging of tokens via Polygon, and the targeting of a gaming-adjacent crypto platform — a pattern Lazarus has been linked to in prior incidents including the 2022 Ronin/Axie Infinity breach. BleepingComputer reported that the magnitude of the attack bears the hallmark traits of Lazarus Group, though noting the attack was not formally attributed to any known threat actor. Elliptic labeled attacker wallets in its tools to assist exchanges in identifying and freezing stolen proceeds. PlayDapp itself stated it could not disclose details that might impact ongoing judicial investigations. The Lazarus Group attribution should be treated as alleged pending formal confirmation from law enforcement or a government authority.","heading":"Alleged Lazarus Group Attribution","sources":[{"url":"https://www.bleepingcomputer.com/news/security/hackers-mint-179-billion-crypto-tokens-from-playdapp-gaming-platform/","name":"Hackers Mint 1.79 Billion Crypto Tokens from PlayDapp — BleepingComputer","type":"news_article","credibility":2},{"url":"https://www.elliptic.co/blog/how-the-lazarus-group-is-stepping-up-crypto-hacks-and-changing-its-tactics","name":"How the Lazarus Group is Stepping Up Crypto Hacks — Elliptic","type":"research","credibility":2},{"url":"https://www.elliptic.co/blog/crypto-gaming-platform-playdapp-suffers-290-million-breach","name":"Crypto Gaming Platform PlayDapp Suffers $290 Million Breach — Elliptic","type":"research","credibility":2}],"severity":"high"},{"content":"PlayDapp suspended the PLA smart contract on February 13, 2024, at 11:05 AM — the contract pause was eventually executed by the attacker themselves, who had control of the deployer key. PlayDapp immediately requested that all major exchanges suspend PLA deposits and withdrawals; exchanges including Coinbase and Binance froze identified attacker wallets within hours. PlayDapp migrated company holdings to secure wallets and communicated with law enforcement in multiple jurisdictions, including threatening FBI involvement if the attacker failed to comply with the white-hat offer. Given the irreversible compromise of the PLA contract's ownership, PlayDapp announced a migration to a new token, PDA (PlayDapp), with a snapshot of legitimate PLA balances taken on February 26, 2024. The migration portal launched on March 13, 2024, allowing users to swap PLA from both Ethereum and Polygon to new ERC-20 PDA tokens at a 1:1 ratio. The new PDA contract incorporated multi-signature authentication and decentralized governance controls to prevent a recurrence of the single-key compromise. Exchanges including Crypto.com and DigiFinex supported the automated swap. By August 2024, over 90 percent of eligible PLA tokens had been successfully migrated to PDA.","heading":"Platform Response and Token Migration","sources":[{"url":"https://playdapp.medium.com/playdapp-post-mortem-on-the-hacking-incident-361b4ddfb5a1","name":"PlayDapp Post-Mortem on the Hacking Incident — PlayDapp Team (Medium)","type":"official","credibility":1},{"url":"https://medium.com/playdappgames/pla-to-pda-token-migration-tutorial-and-faq-a539ded1b42f","name":"PLA to PDA Token Migration Tutorial and FAQ — PlayDapp Team (Medium)","type":"official","credibility":1},{"url":"https://mpost.io/playdapp-reveals-migration-plan-after-secondary-hack-attack-led-to-issuance-of-1-59b-pla-tokens/","name":"PlayDapp Reveals Migration Plan after Secondary Hack — Metaverse Post","type":"news_article","credibility":2},{"url":"https://crypto.com/us/product-news/crypto-com-supports-the-playdapp-token-migration","name":"Crypto.com Supports the PlayDapp Token Migration","type":"news_article","credibility":2}],"severity":"high"},{"content":"The root cause of the exploit was a single point of failure in the PLA token's access control design: minter privileges were gated by a single externally-owned account (EOA) — the contract deployer address — rather than a multi-signature wallet or time-locked governance mechanism. Once the private key to that EOA was stolen, the attacker had unconditional and irrevocable ability to assign new minters and mint arbitrary token quantities. Security firm Halborn categorized the vulnerability as an access control flaw, noting the absence of any rate-limiting, time-lock, or multi-party approval on minting operations. The original PLA contract (0x3a4f40631a4f906c2BaD353Ed06De7A5D3fCb430) provided no on-chain safeguards against a compromised owner key. The new PDA contract introduced multi-signature requirements for sensitive operations, directly addressing the weakness exploited in the attack. The incident is frequently cited in post-2024 security literature as a case study in the risks of single-key ownership of high-value token contracts.","heading":"Smart Contract Security Analysis","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-playdapp-hack-february-2024","name":"Explained: The PlayDapp Hack (February 2024) — Halborn","type":"research","credibility":2},{"url":"https://medium.com/nefture/playdapp-exploit-post-mortem-of-a-290m-heist-f6803349cde8","name":"PlayDapp Exploit Post-Mortem of a $290M Heist — Nefture Security (Medium)","type":"research","credibility":2},{"url":"https://crypto.news/hacker-manipulates-playdapp-minting-pla-plummets/","name":"Hacker Manipulates PlayDapp's Minting Process, PLA Plummets — Crypto.news","type":"news_article","credibility":2}],"severity":"critical"}],"timeline":[{"date":"2017","event":"PlayDapp (SuperTree) founded in Seoul, South Korea.","source":"IQ.wiki — PlayDapp","source_url":"https://iq.wiki/wiki/playdapp","date_original":"2017-01-01"},{"date":"2019","event":"CryptoDozer and DozerBird, PlayDapp's first blockchain games, launch on Ethereum. CryptoDozer surpasses CryptoKitties in daily transaction volume.","source":"IQ.wiki — PlayDapp","source_url":"https://iq.wiki/wiki/playdapp","date_original":"2019-01-01"},{"date":"2024-01-16","event":"A PlayDapp team member receives a domain-spoofed phishing email mimicking a trusted exchange partner. Opening the attachment installs a malicious remote-access tool, leading to exfiltration of the contract deployer private key.","source":"PlayDapp Post-Mortem — PlayDapp Team (Medium)","source_url":"https://playdapp.medium.com/playdapp-post-mortem-on-the-hacking-incident-361b4ddfb5a1"},{"date":"2024-02-09","event":"Attacker uses the stolen deployer private key to add wallet 0xD151050d43c28690766f50Ce9ea8686c5D243a40 as an authorized minter. 200 million PLA tokens (~$36.5 million) are minted and dispersal to exchanges begins.","source":"PlayDapp Post-Mortem — PlayDapp Team (Medium)","source_url":"https://playdapp.medium.com/playdapp-post-mortem-on-the-hacking-incident-361b4ddfb5a1"},{"date":"2024-02-10","event":"PlayDapp detects the unauthorized minting. Platform alerts partner exchanges and requests suspension of PLA deposits and withdrawals.","source":"Explained: The PlayDapp Hack — Halborn","source_url":"https://www.halborn.com/blog/post/explained-the-playdapp-hack-february-2024"},{"date":"2024-02-11","event":"PlayDapp broadcasts an on-chain message to the attacker offering a $1 million white-hat bounty in exchange for return of contract control and all stolen assets, with a deadline of February 13 at 3:00 AM ET.","source":"Crypto Gaming Platform PlayDapp Suffers $290 Million Breach — Elliptic","source_url":"https://www.elliptic.co/blog/crypto-gaming-platform-playdapp-suffers-290-million-breach"},{"date":"2024-02-12","event":"Negotiations break down at 3:35 PM. At 10:09 PM, the attacker mints an additional 1.59 billion PLA tokens (~$253.9 million), bringing total illegitimate minting to 1.79 billion tokens and cumulative nominal losses to ~$290.4 million.","source":"PlayDapp Post-Mortem — PlayDapp Team (Medium)","source_url":"https://playdapp.medium.com/playdapp-post-mortem-on-the-hacking-incident-361b4ddfb5a1"},{"date":"2024-02-13","event":"PLA smart contract is paused at 11:05 AM, halting further minting. PlayDapp threatens FBI referral and full law enforcement engagement if the attacker does not comply. Elliptic labels attacker wallets in its compliance tools.","source":"Hackers Mint 1.79 Billion Crypto Tokens from PlayDapp — BleepingComputer","source_url":"https://www.bleepingcomputer.com/news/security/hackers-mint-179-billion-crypto-tokens-from-playdapp-gaming-platform/"},{"date":"2024-02-26","event":"Snapshot of legitimate PLA token balances taken as the basis for the upcoming 1:1 migration to the new PDA token.","source":"PLA to PDA Token Migration Tutorial and FAQ — PlayDapp Team (Medium)","source_url":"https://medium.com/playdappgames/pla-to-pda-token-migration-tutorial-and-faq-a539ded1b42f"},{"date":"2024-03-13","event":"PlayDapp migration portal launches, allowing PLA holders on Ethereum and Polygon to swap to new ERC-20 PDA tokens at a 1:1 ratio. The new contract includes multi-signature controls.","source":"PlayDapp Post-Mortem — PlayDapp Team (Medium)","source_url":"https://playdapp.medium.com/playdapp-post-mortem-on-the-hacking-incident-361b4ddfb5a1"},{"date":"2024-08","event":"PlayDapp reports that over 90 percent of eligible PLA tokens have been successfully migrated to PDA.","source":"Updates on PLA to PDA Token Migration — PlayDapp Team (Medium)","source_url":"https://medium.com/playdappgames/updates-on-pla-to-pda-token-migration-8fd3ad213069","date_original":"2024-08-01"}],"sources_used":[{"url":"https://playdapp.medium.com/playdapp-post-mortem-on-the-hacking-incident-361b4ddfb5a1","name":"PlayDapp Post-Mortem on the Hacking Incident — PlayDapp Team (Medium)","type":"official","archive_url":"http://web.archive.org/web/20260715113121/https://playdapp.medium.com/playdapp-post-mortem-on-the-hacking-incident-361b4ddfb5a1","credibility":1,"archive_timestamp":"2026-07-15T11:31:21+00:00"},{"url":"https://www.elliptic.co/blog/crypto-gaming-platform-playdapp-suffers-290-million-breach","name":"Crypto Gaming Platform PlayDapp Suffers $290 Million Breach — Elliptic","type":"research","archive_url":"http://web.archive.org/web/20260720151233/https://www.elliptic.co/blog/crypto-gaming-platform-playdapp-suffers-290-million-breach","credibility":2,"archive_timestamp":"2026-07-20T15:12:33+00:00"},{"url":"https://www.bleepingcomputer.com/news/security/hackers-mint-179-billion-crypto-tokens-from-playdapp-gaming-platform/","name":"Hackers Mint 1.79 Billion Crypto Tokens from PlayDapp Gaming Platform — BleepingComputer","type":"news_article","archive_url":"http://web.archive.org/web/20260209010444/https://www.bleepingcomputer.com/news/security/hackers-mint-179-billion-crypto-tokens-from-playdapp-gaming-platform/","credibility":2,"archive_timestamp":"2026-02-09T01:04:44+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-playdapp-hack-february-2024","name":"Explained: The PlayDapp Hack (February 2024) — Halborn","type":"research","archive_url":"http://web.archive.org/web/20260315165351/https://www.halborn.com/blog/post/explained-the-playdapp-hack-february-2024","credibility":2,"archive_timestamp":"2026-03-15T16:53:51+00:00"},{"url":"https://medium.com/nefture/playdapp-exploit-post-mortem-of-a-290m-heist-f6803349cde8","name":"PlayDapp Exploit Post-Mortem of a $290M Heist — Nefture Security (Medium)","type":"research","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cointelegraph.com/news/playdapp-exploit-continues-4th-day-losses-reaching-290-million","name":"PlayDapp Exploit Continues 4th Day, Losses Reaching $290M — CoinTelegraph","type":"news_article","archive_url":"http://web.archive.org/web/20250815173603/https://cointelegraph.com/news/playdapp-exploit-continues-4th-day-losses-reaching-290-million","credibility":2,"archive_timestamp":"2025-08-15T17:36:03+00:00"},{"url":"https://www.theblock.co/post/277334/crypto-gaming-platform-playdapp-loses-290-million-worth-of-tokens-in-two-exploits-elliptic","name":"Crypto Gaming Platform PlayDapp Loses $290 Million — The Block","type":"news_article","archive_url":null,"credibility":1,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://medium.com/playdappgames/pla-to-pda-token-migration-tutorial-and-faq-a539ded1b42f","name":"PLA to PDA Token Migration Tutorial and FAQ — PlayDapp Team (Medium)","type":"official","archive_url":"http://web.archive.org/web/20260714113401/https://medium.com/playdappgames/pla-to-pda-token-migration-tutorial-and-faq-a539ded1b42f","credibility":1,"archive_timestamp":"2026-07-14T11:34:01+00:00"},{"url":"https://mpost.io/playdapp-reveals-migration-plan-after-secondary-hack-attack-led-to-issuance-of-1-59b-pla-tokens/","name":"PlayDapp Reveals Migration Plan after Secondary Hack — Metaverse Post","type":"news_article","archive_url":"https://web.archive.org/web/20260725093517/https://mpost.io/playdapp-reveals-migration-plan-after-secondary-hack-attack-led-to-issuance-of-1-59b-pla-tokens/","credibility":2,"archive_timestamp":"2026-07-25T09:35:17+00:00"},{"url":"https://www.elliptic.co/blog/how-the-lazarus-group-is-stepping-up-crypto-hacks-and-changing-its-tactics","name":"How the Lazarus Group is Stepping Up Crypto Hacks — Elliptic","type":"research","archive_url":"http://web.archive.org/web/20260511085148/https://www.elliptic.co/blog/how-the-lazarus-group-is-stepping-up-crypto-hacks-and-changing-its-tactics","credibility":2,"archive_timestamp":"2026-05-11T08:51:48+00:00"},{"url":"https://iq.wiki/wiki/playdapp","name":"PlayDapp — IQ.wiki","type":"research","archive_url":"http://web.archive.org/web/20260420001755/https://iq.wiki/wiki/playdapp","credibility":2,"archive_timestamp":"2026-04-20T00:17:55+00:00"},{"url":"https://crypto.news/hacker-manipulates-playdapp-minting-pla-plummets/","name":"Hacker Manipulates PlayDapp's Minting Process, PLA Plummets — Crypto.news","type":"news_article","archive_url":"http://web.archive.org/web/20260307215417/https://crypto.news/hacker-manipulates-playdapp-minting-pla-plummets/","credibility":2,"archive_timestamp":"2026-03-07T21:54:17+00:00"},{"url":"https://crypto.com/us/product-news/crypto-com-supports-the-playdapp-token-migration","name":"Crypto.com Supports the PlayDapp Token Migration","type":"news_article","archive_url":"http://web.archive.org/web/20251215201259/https://crypto.com/us/product-news/crypto-com-supports-the-playdapp-token-migration","credibility":2,"archive_timestamp":"2025-12-15T20:12:59+00:00"},{"url":"https://medium.com/playdappgames/updates-on-pla-to-pda-token-migration-8fd3ad213069","name":"Updates on PLA to PDA Token Migration — PlayDapp Team (Medium)","type":"official","archive_url":null,"credibility":1,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://crypto.news/playdapp-breach-hack-crypto-290-million/","name":"PlayDapp Breach 8th Largest Hack in Crypto History at $290M — Crypto.news","type":"news_article","archive_url":"http://web.archive.org/web/20260515014833/https://crypto.news/playdapp-breach-hack-crypto-290-million/","credibility":2,"archive_timestamp":"2026-05-15T01:48:33+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-5","created_at":"2026-05-30T12:59:42.39694+00:00","updated_at":"2026-10-10T18:49:10.103+00:00"},"source_quality":{"total":17,"tier1":0,"tier2":4,"tier3":0,"unrated":13},"follower_count":null,"content_updated_at":"2026-10-10T18:49:10.344Z","last_fact_checked_at":"2026-08-26T11:17:43.442Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}