Audit log

Every state-changing event for Munchables: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-20 15:41:08Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 421,014,711

   sig

   W7atPdnJk1vh…YJKKuVNScopyexplorer ↗

   hash

   5MAt4mTSTofT…yi1HJXb6copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (4997 B) ▸

   {"actor":"system:backfill","investigation_id":"5d7315a6-ce77-4a91-8b18-103e04faad57","kind":"publish","page_slug":"munchables","published_at":"2026-05-20T15:41:08.855Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Munchables","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/284883/web3-gaming-platform-munchables-loses-62-5-million-in-exploit-zachxbt"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/nft-game-munchables-blast-exploited-62-million"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/tech/2024/03/27/munchables-exploited-for-62m-ether-linked-to-rogue-north-korean-team-member"},{"credibility":3,"name":"","type":"other","url":"https://rekt.news/munchables-rekt"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-munchables-hack-march-2024"},{"credibility":3,"name":"","type":"other","url":"https://thedefiant.io/news/defi/analysts-believe-munchables-usd63m-exploit-was-internally-engineered"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/284883/web3-gaming-platform-munchables-loses-62-5-million-in-exploit-zachxbt"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-munchables-hack-march-2024"},{"credibility":3,"name":"","type":"other","url":"https://unchainedcrypto.com/third-party-blast-bridges-disabled-after-munchables-loses-62-million-in-exploit/"},{"credibility":3,"name":"","type":"other","url":"https://rekt.news/munchables-rekt"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://cryptoslate.com/munchables-recovers-62-5-million-in-user-funds-after-exploit-linked-to-north-korean-hacker/"},{"credibility":3,"name":"","type":"other","url":"https://decrypt.co/223644/blast-nft-game-munchables-recovers-62-million-exploit"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/zachxbt-onboarded-custodian-return-funds-defi-exploit"},{"credibility":3,"name":"","type":"other","url":"https://cryptodaily.co.uk/news-in-crypto/observers:munchables-will-re-release-after-62m-hack-but-rollback-security-issues-linger"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/opinion/2024/03/27/the-munchables-hack-is-way-worse-than-it-seems"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-munchables-hack-march-2024"},{"credibility":3,"name":"","type":"other","url":"https://cryptonews.net/news/security/29526952/"},{"credibility":3,"name":"","type":"other","url":"https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/munchables.md"}]}],"sources_used":[],"summary":"Munchables is a Blast-chain NFT game that suffered a $62.5 million exploit on March 26, 2024, when a contractor later attributed to North Korea exploited a backdoor they had embedded in the project's upgradeable smart contracts before launch. The developer surrendered private keys and the full sum was recovered within approximately 24 hours, but the incident exposed fundamental failures in contractor due diligence and smart contract architecture.","timeline":[{"date":"2022-01-01","event":"A developer later linked to the Munchables exploit was briefly hired by Pixecraft Studios, described as 'sketchy,' and let go within a month.","source":""},{"date":"2024-03-21","event":"The Munchables Lock smart contract was upgraded to an unverified implementation address, later identified as part of the attacker's preparation.","source":""},{"date":"2024-03-26","event":"The exploit was executed: approximately 17,413 ETH (~$62.5M) was withdrawn by the rogue developer using a pre-planted fraudulent 1,000,000 ETH balance in storage slots.","source":""},{"date":"2024-03-26","event":"Munchables announced the breach on X at approximately 9:33 pm UTC and stated it was tracking the exploiter.","source":""},{"date":"2024-03-26","event":"ZachXBT identified the attacker's address and four GitHub accounts (NelsonMurua913, Werewolves0493, BrightDragon0719, Super1114) believed to be North Korean-linked.","source":""},{"date":"2024-03-26","event":"Within approximately 11 minutes of ZachXBT's public identification, the developer agreed to return all funds and surrendered private keys.","source":""},{"date":"2024-03-27","event":"Blast founder Pacman confirmed that the recovered assets had been secured in a multisig controlled by Blast core contributors.","source":""},{"date":"2024-03-27","event":"Munchables announced full fund recovery; community rollback proposals for the Blast chain were not pursued.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d26f5809-a84e-4789-86d7-af8e47043736copy
2. #2reviewby reviewerreviewer

   2026-11-02 04:04:19Z
   Score: 10 → 10 (no score change)
   The core narrative holds: $62.5M exploit, rogue developer, proxy and storage-slot backdoor, key surrender about 11 minutes after ZachXBT's post, and the $97M multisig. The $6,220 MEXC figure, the 'sketchy' quote, the shared deposit addresses and the 24-hour recovery window could not be verified. The 'full sum recovered' wording sits uneasily with sources citing about $60.5M returned. The page omits the Blast network shutdown announced in October 2026.
   anchoranchored

   chain

   ●mainnet-betaslot 464,354,191

   sig

   3X4A6jRJhnqq…PyBAb152copyexplorer ↗

   hash

   4yJRT9tUbeuQ…sPME83CNcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1303 B) ▸

   {"actor":"reviewer","artifact_identity":"2afd8958730620427beb2e48cae2eb2c","decided_at":"2026-11-02T04:04:19.350Z","decision":"review","disputed_pct":0.2222,"findings_hash":"CAtFh588tnEx7DEUcGCcwhBbxCJKDYUfjDpfMtnBF1QG","investigation_id":"5d7315a6-ce77-4a91-8b18-103e04faad57","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":10,"omissions":{"material":1,"total":1},"page_content_hash":"f231bf6e37ff949ea598a81a987ae807393e6ac9641442c3ead72d976be689bd","page_slug":"munchables","prev_score":10,"reason":"The core narrative holds: $62.5M exploit, rogue developer, proxy and storage-slot backdoor, key surrender about 11 minutes after ZachXBT's post, and the $97M multisig. The $6,220 MEXC figure, the 'sketchy' quote, the shared deposit addresses and the 24-hour recovery window could not be verified. The 'full sum recovered' wording sits uneasily with sources citing about $60.5M returned. The page omits the Blast network shutdown announced in October 2026.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":2,"subject_status":"unknown","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision cddd8dbe-82c0-4375-b9d7-e1612917cb64copy
3. #3review reviseby judgejudge

   2026-11-02 04:04:19Z
   Score: 10 → 0 (-16)
   The core account of the $62.5M exploit, the rogue developer, the proxy backdoor, the key surrender about 11 minutes after ZachXBT's post and the $97M multisig held up (claim_findings[0], [5], [6], [7]). Two claims could not be verified (the shared deposit addresses and the $6,220 MEXC figure, claim_findings[2] and [4]). The 'full sum recovered' wording conflicts with sources citing about $60.5M returned (claim_findings[1]). The page also does not mention the October 2026 shutdown of the Blast network, which the review rates a material omission (omission_findings[0]), and the project's current status is unknown. For these reasons the page is revised and placed under investigation, with a moderate penalty because the reviewer's confidence is moderate and no claim was directly contradicted.
   anchoranchored

   chain

   ●mainnet-betaslot 464,354,197

   sig

   5FF7vFABpqEr…xxxiyQJ1copyexplorer ↗

   hash

   7sdzfMBCLsS3…tAKKGLDMcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1882 B) ▸

   {"actor":"judge","artifact_identity":"2afd8958730620427beb2e48cae2eb2c","band_override":null,"decided_at":"2026-11-02T04:04:19.350Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.2222,"investigation_id":"5d7315a6-ce77-4a91-8b18-103e04faad57","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":0,"page_slug":"munchables","prev_score":10,"reason":"The core account of the $62.5M exploit, the rogue developer, the proxy backdoor, the key surrender about 11 minutes after ZachXBT's post and the $97M multisig held up (claim_findings[0], [5], [6], [7]). Two claims could not be verified (the shared deposit addresses and the $6,220 MEXC figure, claim_findings[2] and [4]). The 'full sum recovered' wording conflicts with sources citing about $60.5M returned (claim_findings[1]). The page also does not mention the October 2026 shutdown of the Blast network, which the review rates a material omission (omission_findings[0]), and the project's current status is unknown. For these reasons the page is revised and placed under investigation, with a moderate penalty because the reviewer's confidence is moderate and no claim was directly contradicted.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":-16,"sequence_num":3,"severity_override":{"applied":true,"band":"significant","from_band":"minor","reason":"The percentage (2 of 9 claims unverifiable, about 22%) implies the minor band. The review reports a material omission: the host chain Blast announced its shutdown in October 2026, and the page's relaunch statement implies the project may still be viable. A high-priority gap on current project status is also open. The band is raised to significant."},"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision edcb9ba5-e585-45e0-94ca-02d80ca6bad0copy