Crypto gaming platform PlayDapp loses $290 million worth of tokens in two exploits: Elliptic

An exploit of crypto gaming platform PlayDapp resulted in the loss of millions worth of the PLA token that powers PlayDapp's gaming platform and NFT marketplace, according to blockchain analytics firm Elliptic. 

Elliptic noted in a Tuesday report that an unauthorized wallet, likely resulting from a private key compromise, minted 200 million PLA tokens worth $36.5 million at the time on Feb. 9.

Shortly after this incident, PlayDapp messaged the exploiter through an on-chain transaction requesting that the hacker return the stolen funds by 3:00 a.m. ET on Feb. 13 for a $1 million white hat reward. If not, PlayDapp said it would issue a $1 million white hat bounty to find the hacker and collaborate with law enforcement.

"Attempts to negotiate with the hacker were unsuccessful as they showed no willingness to help recover holders' losses," PlayDapp wrote in a Tuesday statement. 

Instead, the hacker minted a further 1.59 billion PLA tokens valued at $253.9 million on Feb. 12 and began laundering the funds through crypto exchanges. 

"Before the breaches, the total circulating supply of PLA tokens was 577 million, so the exploiter may find it difficult to sell the 1.8 billion newly-minted tokens at anything close to their market value prior to the hacks," Elliptic wrote. 

Paused smart contracts

On Feb. 13, PlayDapp wrote on the social media platform X that the PLA smart contract had been paused.

"We kindly request the halt of transactions to conduct a snapshot for migration," it said. "Please understand that we are doing everything to protect holders' assets, and we will continue to keep the community updated."

PlayDapp added that it is working with crypto exchanges, blockchain forensic firms and law enforcement. In addition, it is tracking minted and swapped tokens and discussing migration solutions, like an airdrop. 

PlayDapp's PLA token was trading for $0.15 as of 10:55 a.m. ET on Feb. 13, decreasing 2.9% over the last 24 hours, according to The Block's Price Page for PLA.