PlayDapp $32 million Hack (#369)

* playdapp hack article

* Update 2024-02-09-PlayDapp.md

---------

Co-authored-by: Evgeny Dmitriev <[email protected]>

content/attacks/posts/2024-02-09-PlayDapp.md

@@ -0,0 +1,40 @@
+---
+date: 2024-02-09
+target-entities: PlayDapp
+entity-types: GameFi
+attack-types: Private Key Compromise
+title: "PlayDapp Suffers $32.35 Million Security Breach"
+loss: 32350000
+---
+
+## Summary
+
+On February 9, 2024, PlayDapp, a Play to Earn (P2E) game based on Ethereum, experienced a security breach due to compromised private keys. The attacker exploited the platform and minted a total of 3.38 billion PLA tokens, which was worth nearly $617 million at the time of an incident. However, the attacker managed to convert the tokens for $32.35 million. The stolen funds were transferred to various addresses, with some deposited into the Polygon chain and Binance exchange, while a significant portion remains in the attacker's address as of February 13, 2024.
+
+## Attackers
+
+The identity of the attacker remains unknown. The attacker used the following Ethereum addresses:
+
+- [0xD151050d43c28690766f50Ce9ea8686c5D243a40](https://etherscan.io/address/0xD151050d43c28690766f50Ce9ea8686c5D243a40)
+- [0x1cae9eAa76E880fe47A26dd838E5Ec056C289155](https://etherscan.io/address/0x1cae9eAa76E880fe47A26dd838E5Ec056C289155)
+- [0xe84d086f2c402d297d05b1bccc06d0e0942ec03c](https://etherscan.io/address/0xe84d086f2c402d297d05b1bccc06d0e0942ec03c)
+
+## Losses
+
+PlayDapp suffered a loss of approximately $32.35 million due to the security breach.
+
+## Timeline
+
+- **February 9, 2024, 01:39 PM UTC:** The attacker [granted minting privilege to himself](https://etherscan.io/tx/0xe834f28377b79759ac5495a91975a01e0876af9aae312228c1ac525846406170) using a compromised wallet.
+- **February 9, 2024, 01:45 PM UTC:** The [first malicious transaction occurred](https://etherscan.io/tx/0xe8be05f6a3360f63b9e78a30b4ba16ea4c7d0b530a8abf99390f1c831851fb7e) with over $14 million worth of PLA tokens minted.
+- **February 9, 2024, 01:54 PM UTC:** Over $3.5 million worth of tokens [were bridged](https://etherscan.io/tx/0x3049ce5537e620c52db831157d8663d5bc26e8ebbb18fc333f3a424516e3ea55) to the Polygon chain.
+- **February 9, 2024, 05:00 PM UTC:** The attacker [started depositing tokens](https://etherscan.io/tx/0x964837f1cffd9d54aae2d8a2083a8927219095ff7857194865b65b1d32669414) to the Binance exchange.
+- **February 9, 2024, 09:01 PM UTC:** PlayDapp [posted a tweet](https://twitter.com/playdapp_io/status/1756060784692736038), claiming they are working along with partner exchanges to resolve an issue.
+- **February 10, 2024, 04:20 AM UTC:** The part of the tokens [were deposited](https://etherscan.io/tx/0x1cb750dfcd6a425eac3013a4b0994eaa719d5e6824196fe3c06dafe4b6fa55a2) to Gate.io exchange.
+- **February 10, 2024, 05:28 AM UTC:** PlayDapp [announced on X](https://twitter.com/playdapp_io/status/1756188275986116782) about transferring of the rest PLA tokens to a new wallet to safeguard assets.
+- **February 10, 2024, 01:52 PM UTC:** PlayDapp [offered a $1 million white hat reward](https://etherscan.io/tx/0xb8c379f3ae8ea3ba48cdb7dac79c9b995f0e7a372a8bf9d620a6bfc875a31628) to the attacker.
+- **February 11, 2024:** Neptune Mutual [posted detailed analysis](https://neptunemutual.com/blog/analysis-of-the-playdapp-exploit/) of the incident.
+
+## Security Failure Causes
+
+- **Compromised Private Key:** The root cause of the exploit is reportedly due to the compromise of the private keys of the privileged address.