← PlayDappreviewed 2026-09-07 · 35 claims checked
Fact-check findings
What an automated fact-checker found when it re-read PlayDapp against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
1 claimThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #16[disputed][awaiting moderator]in section: Second Minting Event and Full Scope of Losses
“The combined total of 1.79 billion illegitimately minted tokens dwarfed the 577 million PLA tokens that had been in legitimate circulation prior to the attack, representing roughly 72 percent of the original total minted supply and inflating the token supply by more than three-fold.”
reviewerThe combined 1.79 billion illegitimately minted tokens dwarfed the 577 million PLA tokens in prior legitimate circulation, representing roughly 72 percent of the original total minted supply and inflating supply by more than three-fold.The sentence is internally self-contradictory: a ratio cannot simultaneously be 'roughly 72 percent' and 'more than three-fold' (~310%). Independent sourcing indicates the 72% figure, as reported elsewhere, describes the first 200M-token mint relative to a different base, not the combined 1.79B total the page applies it to.Proposed correction (not yet applied)The combined total of 1.79 billion illegitimately minted tokens dwarfed the 577 million PLA tokens that had been in legitimate circulation prior to the attack, inflating the token supply by more than three-fold.
link rot
2 claimsA cited source no longer resolves or no longer says what the page attributes to it.
- #34[link rot][awaiting moderator]in section: Platform Response and Token Migration
“https://crypto.com/us/product-news/crypto-com-supports-the-playdapp-token-migration”
reviewerSource citation: Crypto.com's PlayDapp migration support announcement is at https://crypto.com/us/product-news/crypto-com-supports-the-playdapp-token-migration.Both the /us/ and /en/ variants of this crypto.com product-news URL 404 on direct fetch. The underlying claim (Crypto.com supported the migration) is independently confirmed via Crypto.com's own social media announcements, but no live replacement article URL could be found. - #35[link rot][awaiting moderator]in the cited sources
“https://crypto.com/us/product-news/crypto-com-supports-the-playdapp-token-migration”
reviewerSource citation (sources_used): same Crypto.com migration support URL as listed in the page's global sources list.Same dead URL appears in the page-level sources_used list; grouped with the section-level occurrence under one defect_group.
partially supported
2 claimsThe cited evidence supports part of the claim but not all of it.
- #3[partially supported][awaiting moderator]in the summary
“The platform subsequently suspended the PLA smart contract and executed a 1:1 migration to a new token (PDA) to remediate the illegitimate token supply.”
reviewerThe platform (PlayDapp) suspended the PLA smart contract and executed a 1:1 migration to PDA.The page's own section 5 correctly notes the pause was 'eventually executed by the attacker themselves,' which contradicts the summary's framing that 'the platform suspended the PLA smart contract.' PlayDapp requested and directed the remediation but did not technically execute the pause. - #22[partially supported][awaiting moderator]in section: Platform Response and Token Migration
“PlayDapp immediately requested that all major exchanges suspend PLA deposits and withdrawals; exchanges including Coinbase and Binance froze identified attacker wallets within hours.”
reviewerPlayDapp requested all major exchanges suspend deposits/withdrawals; Coinbase and Binance froze identified attacker wallets within hours.The general claim that exchanges suspended activity and froze suspected wallets (34 addresses, per multiple secondary sources) is well corroborated; Coinbase's freeze is directly confirmed, but Binance's specific action is better documented as a delisting than a wallet freeze.
confirmed
30 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“PlayDapp is a South Korean blockchain gaming platform and NFT marketplace founded in 2017 and operating on Ethereum and Polygon.”
reviewerPlayDapp is a South Korean blockchain gaming platform and NFT marketplace founded in 2017, operating on Ethereum and Polygon.Matches IQ.wiki and general reporting consistently. - #2[confirmed][no action needed]in the summary
“In February 2024, an attacker who had obtained PlayDapp's contract deployer private key via a phishing email added themselves as an authorized minter and minted 1.79 billion PLA tokens across two events, representing a nominal loss of approximately $290 million.”
reviewerIn February 2024 an attacker obtained the deployer private key via phishing, added themselves as an authorized minter, and minted 1.79 billion PLA across two events worth ~$290 million.Core facts of the incident are well corroborated across multiple independent outlets. - #4[confirmed][no action needed]in section: Platform Background
“The platform is operated by SuperTree, which was selected as part of Samsung Electronics' C-Lab Outside program in 2019.”
reviewerPlayDapp is operated by SuperTree, selected for Samsung Electronics' C-Lab Outside program in 2019.Confirmed via cited source and independent search corroboration. - #5[confirmed][no action needed]in section: Platform Background
“Leadership includes Brian Choi (CEO), Moshua Choi (Head of Strategy), Ozzy Koh (Head of Technology), and Sang Chung (Head of Business).”
reviewerLeadership includes Brian Choi (CEO), Moshua Choi (Head of Strategy), Ozzy Koh (Head of Technology), and Sang Chung (Head of Business).Names and titles match the cited source exactly. - #6[confirmed][no action needed]in section: Platform Background
“Its first titles, CryptoDozer and DozerBird, launched in 2019; CryptoDozer briefly surpassed CryptoKitties in daily transaction volume.”
reviewerCryptoDozer and DozerBird, PlayDapp's first titles, launched in 2019; CryptoDozer briefly surpassed CryptoKitties in daily transaction volume.Core surpassing claim well corroborated; the specific 'daily' granularity could not be independently pinned down but is not contradicted. - #7[confirmed][no action needed]in section: Platform Background
“The PLA token is an ERC-20 token with a designed total supply of 700 million, listed on Coinbase, MEXC, Uniswap, and QuickSwap.”
reviewerPLA is an ERC-20 token with a designed total supply of 700 million, listed on Coinbase, MEXC, Uniswap, and QuickSwap.Exact match to cited source. - #8[confirmed][no action needed]in section: Platform Background
“PlayDapp secured $2.5 million in seed funding.”
reviewerPlayDapp secured $2.5 million in seed funding.Confirmed. - #9[confirmed][no action needed]in section: Platform Background
“In early January 2024, PLA traded at approximately $0.22 with a market capitalization of roughly $124 million.”
reviewerIn early January 2024, PLA traded at approximately $0.22 with a market capitalization of roughly $124 million.Price figure corroborated by multiple sources; market cap is internally consistent with circulating supply figures elsewhere on the page. - #10[confirmed][no action needed]in section: The February 2024 Private Key Compromise
“On January 16, 2024, at approximately 11:13 AM (UTC+9), a member of PlayDapp's team received a domain-spoofed phishing email crafted to appear identical to legitimate communications from a major exchange partner — matching sender address, subject line, and body content.”
reviewerOn January 16, 2024, at approximately 11:13 AM (UTC+9), a PlayDapp team member received a domain-spoofed phishing email matching a trusted exchange partner's communications.General date and mechanism well corroborated; the precise timestamp (11:13 AM) rests on the primary source, which could not be directly re-fetched due to anti-bot blocking. - #11[confirmed][no action needed]in section: The February 2024 Private Key Compromise
“On February 9, 2024, at 10:39 PM (UTC+9), the attacker used the compromised deployer key to call the contract's access control function, adding their own wallet as an authorized PLA minter. The attacker immediately minted 200 million PLA tokens, valued at approximately $36.5 million at prevailing prices.”
reviewerOn February 9, 2024 at 10:39 PM (UTC+9), the attacker added themselves as an authorized minter and immediately minted 200 million PLA tokens worth ~$36.5 million.Amounts, date, and time independently corroborated. - #12[confirmed][no action needed]in section: The February 2024 Private Key Compromise
“PlayDapp detected the incident on February 10 and broadcast an on-chain message to the attacker on February 11, offering a $1 million white-hat bounty in exchange for return of contract access and all stolen funds by February 13, 2024, at 3:00 AM ET.”
reviewerPlayDapp detected the incident on February 10 and broadcast a $1 million white-hat bounty offer on-chain on February 11, with a deadline of February 13, 3:00 AM ET.Confirmed across multiple sources. - #13[confirmed][no action needed]in section: The February 2024 Private Key Compromise
“The attacker did not respond to the offer, and negotiations broke down by February 12, 3:35 PM.”
reviewerThe attacker did not respond, and negotiations broke down by February 12, 3:35 PM.Time matches independent search corroboration of the primary source. - #14[confirmed][no action needed]in section: The February 2024 Private Key Compromise
“Blockchain security firm PeckShield confirmed the attack vector as a private key leak, and Elliptic noted funds had begun moving to multiple accounts almost immediately.”
reviewerPeckShield confirmed the attack vector as a private key leak, and Elliptic noted funds moving to multiple accounts almost immediately.Both attributions confirmed against fetched source content. - #15[confirmed][no action needed]in section: Second Minting Event and Full Scope of Losses
“After negotiations failed on February 12, 2024, at 10:09 PM (UTC+9), the attacker minted an additional 1.59 billion PLA tokens, valued at approximately $253.9 million at the time of minting.”
reviewerAfter negotiations failed, on February 12, 2024 at 10:09 PM (UTC+9) the attacker minted an additional 1.59 billion PLA tokens worth ~$253.9 million.Confirmed across multiple independent sources. - #17[confirmed][no action needed]in section: Second Minting Event and Full Scope of Losses
“The combined nominal value of both minting events reached approximately $290.4 million, placing the incident among the largest single crypto asset thefts to that date.”
reviewerThe combined nominal value of both minting events reached approximately $290.4 million, placing the incident among the largest single crypto asset thefts to that date.Figure and superlative framing corroborated. - #18[confirmed][no action needed]in section: Second Minting Event and Full Scope of Losses
“The attacker's wallet addresses identified by security researchers include 0xD151050d43c28690766f50Ce9ea8686c5D243a40, 0x1cae9eAa76E880fe47A26dd838E5Ec056C289155, 0xe84d086f2c402d297d05b1bccc06d0e0942ec03c, and 0x23cAeE3666b553445e430D1635AD64fBF388B07d.”
reviewerThe attacker's wallet addresses identified by security researchers include four specific 0x addresses.All four addresses matched exactly against independent secondary reporting on the incident's forensic writeups. - #19[confirmed][no action needed]in section: Second Minting Event and Full Scope of Losses
“Due to the massive token supply inflation, the attacker was only able to liquidate an estimated $32 million worth of PLA before exchange precautions halted further conversion. Approximately 163 million tokens were attempted to be deposited at exchanges but were largely frozen.”
reviewerThe attacker was only able to liquidate an estimated $32 million before exchange precautions halted further conversion; approximately 163 million tokens attempted deposits at exchanges were largely frozen.Both figures independently corroborated via multiple secondary summaries of the post-mortem. - #20[confirmed][no action needed]in section: Alleged Lazarus Group Attribution
“BleepingComputer reported that the magnitude of the attack bears the hallmark traits of Lazarus Group, though noting the attack was not formally attributed to any known threat actor.”
reviewerBleepingComputer reported the attack bears hallmarks of Lazarus Group but was not formally attributed to any known threat actor.Direct fetch confirmed this is an accurate, appropriately hedged paraphrase of the cited source; the page correctly avoids stating attribution as fact. - #21[confirmed][no action needed]in section: Platform Response and Token Migration
“PlayDapp suspended the PLA smart contract on February 13, 2024, at 11:05 AM — the contract pause was eventually executed by the attacker themselves, who had control of the deployer key.”
reviewerPlayDapp suspended the PLA smart contract on February 13, 2024 at 11:05 AM, but the pause was ultimately executed by the attacker via the compromised deployer key.This is the more accurate framing on the page; it directly conflicts with the summary's simpler claim that 'the platform... suspended the PLA smart contract' (see separate finding). - #23[confirmed][no action needed]in section: Platform Response and Token Migration
“PlayDapp migrated company holdings to secure wallets and communicated with law enforcement in multiple jurisdictions, including threatening FBI involvement if the attacker failed to comply with the white-hat offer.”
reviewerPlayDapp migrated company holdings to secure wallets, communicated with law enforcement in multiple jurisdictions, and threatened FBI involvement if the attacker did not comply.FBI threat independently corroborated; the 'migrated company holdings to secure wallets' detail is plausible standard incident-response practice but was not independently verified beyond the primary source. - #24[confirmed][no action needed]in section: Platform Response and Token Migration
“Given the irreversible compromise of the PLA contract's ownership, PlayDapp announced a migration to a new token, PDA (PlayDapp), with a snapshot of legitimate PLA balances taken on February 26, 2024.”
reviewerA snapshot of legitimate PLA balances was taken on February 26, 2024 as the basis for the PDA migration.Confirmed. - #25[confirmed][no action needed]in section: Platform Response and Token Migration
“The migration portal launched on March 13, 2024, allowing users to swap PLA from both Ethereum and Polygon to new ERC-20 PDA tokens at a 1:1 ratio.”
reviewerThe migration portal launched on March 13, 2024, allowing users to swap PLA on Ethereum and Polygon to PDA at a 1:1 ratio.Confirmed. - #26[confirmed][no action needed]in section: Platform Response and Token Migration
“The new PDA contract incorporated multi-signature authentication and decentralized governance controls to prevent a recurrence of the single-key compromise.”
reviewerThe new PDA contract incorporated multi-signature authentication and decentralized governance controls to prevent a recurrence of the single-key compromise.Confirmed, and the actual remediation appears at least as robust as described (minting function reportedly eliminated entirely). - #27[confirmed][no action needed]in section: Platform Response and Token Migration
“Exchanges including Crypto.com and DigiFinex supported the automated swap.”
reviewerExchanges including Crypto.com and DigiFinex supported the automated PLA-to-PDA swap.The underlying claim is confirmed via alternate sourcing; the specific cited crypto.com URL itself is dead (flagged separately as link rot). - #28[confirmed][no action needed]in section: Platform Response and Token Migration
“By August 2024, over 90 percent of eligible PLA tokens had been successfully migrated to PDA.”
reviewerBy August 2024, over 90 percent of eligible PLA tokens had been successfully migrated to PDA.Confirmed. - #29[confirmed][no action needed]in section: Smart Contract Security Analysis
“The root cause of the exploit was a single point of failure in the PLA token's access control design: minter privileges were gated by a single externally-owned account (EOA) — the contract deployer address — rather than a multi-signature wallet or time-locked governance mechanism.”
reviewerThe root cause was a single point of failure: minter privileges were gated by a single EOA (the deployer address) rather than multisig or time-locked governance.Well corroborated by convergent secondary sourcing even though the primary Halborn URL could not be directly re-fetched in this review. - #30[confirmed][no action needed]in section: Smart Contract Security Analysis
“Security firm Halborn categorized the vulnerability as an access control flaw, noting the absence of any rate-limiting, time-lock, or multi-party approval on minting operations.”
reviewerHalborn categorized the vulnerability as an access control flaw, noting the absence of rate-limiting, time-lock, or multi-party approval.Moderate confidence: could not directly re-fetch the Halborn article in this session, but no contradicting information was found and the characterization matches the broader security-research consensus on this incident. - #31[confirmed][no action needed]in section: Smart Contract Security Analysis
“The original PLA contract (0x3a4f40631a4f906c2BaD353Ed06De7A5D3fCb430) provided no on-chain safeguards against a compromised owner key.”
reviewerThe original PLA contract address is 0x3a4f40631a4f906c2BaD353Ed06De7A5D3fCb430, which provided no on-chain safeguards against a compromised owner key.Address verified as an exact character-for-character match against the live Etherscan record. - #32[confirmed][no action needed]in section: Smart Contract Security Analysis
“The new PDA contract introduced multi-signature requirements for sensitive operations, directly addressing the weakness exploited in the attack.”
reviewerThe new PDA contract introduced multi-signature requirements for sensitive operations, directly addressing the exploited weakness.Confirmed, consistent with the earlier section 5 claim about PDA's security redesign. - #33[confirmed][no action needed]in section: Smart Contract Security Analysis
“The incident is frequently cited in post-2024 security literature as a case study in the risks of single-key ownership of high-value token contracts.”
reviewerThe incident is frequently cited in post-2024 security literature as a case study in the risks of single-key ownership of high-value token contracts.A reasonable number of independent security-research writeups treating this as a case study were located, supporting the 'frequently cited' characterization, though 'frequently' is inherently a soft qualitative judgment.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.