← Munchablesreviewed 2026-11-02 · 9 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Munchables against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
2 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #3[unverifiable][awaiting moderator]in section: The North Korean Developer Backdoor
“These accounts had mutually endorsed one another for the Munchables developer role and reportedly transferred payments to the same two exchange deposit addresses, suggesting coordination.”
reviewerFour GitHub accounts mutually endorsed each other and sent payments to the same two exchange deposit addressesThe four-identities-one-person claim is supported. The endorsement and shared deposit address detail was not found in the fetched text. - #5[unverifiable][awaiting moderator]in section: The $62.5M Drain
“Only $6,220 worth of ETH was actually moved off-chain by the attacker via a MEXC deposit address before the funds were frozen and negotiations began.”
reviewerAttacker withdrew about 17,413 ETH, with only $6,220 moved off-chain via MEXCThe $6,220 MEXC figure is absent from Rekt, CoinDesk, Halborn and Decrypt as fetched. Rekt says about $60.5M came back, which does not match 'only $6,220' unrecovered.
partially supported
3 claimsThe cited evidence supports part of the claim but not all of it.
- #2[partially supported][awaiting moderator]in the summary
“The developer surrendered private keys and the full sum was recovered within approximately 24 hours”
reviewerThe full sum was recoveredMunchables said it received keys to the full funds, but Rekt and Halborn cite about $60.5M restored. The page itself later says $6,220 went unrecovered, so 'full sum' is slightly inconsistent. The '24 hours' figure is not confirmed by any source I fetched. - #4[partially supported][awaiting moderator]in section: The North Korean Developer Backdoor
“The Pixecraft Studios CEO later noted publicly that the same developer had been hired on a trial basis in 2022 and was described as 'sketchy' before being let go within a month”
reviewerPixecraft CEO described the developer as sketchy and let him go within a month in 2022Trial hire in 2022 for under a month is confirmed. The 'sketchy' quote was not verified. - #9[partially supported][awaiting moderator]in section: Funds Returned
“Munchables subsequently indicated plans to relaunch the project.”
reviewerMunchables subsequently indicated plans to relaunchPlan stated in 2024; no evidence found that a relaunch happened. The host chain Blast has since announced its shutdown.
confirmed
4 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“Munchables is a Blast-chain NFT game that suffered a $62.5 million exploit on March 26, 2024, when a contractor later attributed to North Korea exploited a backdoor they had embedded in the project's upgradeable smart contracts before launch.”
reviewerMunchables suffered a $62.5 million exploit on March 26, 2024 via a backdoor planted by a contractor linked to North KoreaCore facts corroborated by several sources. - #6[confirmed][no action needed]in section: Funds Returned
“Within approximately 11 minutes of ZachXBT publicly identifying the attacker's address and alleged identity, the responsible developer agreed to return the funds without conditions or ransom demands.”
reviewerThe developer agreed to return funds within about 11 minutes of ZachXBT's identificationSupported. - #7[confirmed][no action needed]in section: Funds Returned
“Blast founder Pacman confirmed on March 27 that the recovered assets — totaling approximately $97 million when including broader Blast contributor holdings — had been secured in a multisig wallet controlled by Blast core contributors.”
reviewerPacman confirmed recovered assets, about $97M including Blast contributor holdings, were secured in a multisigSupported. The samczsun credit and rollback discussion were not seen in the Decrypt text. - #8[confirmed][no action needed]in section: Risk Assessment
“the proxy contract's upgradeability was controlled by a developer-owned deployer address rather than a project-controlled multisig or timelock”
reviewerProxy upgradeability controlled by developer-owned deployer addressSupported.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.