They Made Themselves a Minter, Came Back Three Days Later, and Did It Again
An access control flaw let an attacker add their own address as an authorized minter on PlayDapp's token contract. They printed 200 million tokens. PlayDapp offered a million dollars to give it back. The attacker returned three days later and printed 1.59 billion more.
PlayDapp was a blockchain gaming and NFT platform, and its PLA token contract had an access control problem. The function that authorized new minters did not adequately check who was calling it. On February 9, 2024, somebody compromised a private key with enough privilege to exploit that gap, added their own address to the list of approved minters, and started printing.
The first run produced 200 million PLA, worth roughly $36.5 million. PlayDapp paused the contract, went public, and did what protocols in that position do: offered the attacker money to stop. A $1 million white hat reward, no questions asked, return the tokens and walk away.
The attacker read the offer and, on February 12, minted 1.59 billion more PLA. Roughly $253.9 million at prevailing prices. Total across both events: about 1.79 billion tokens, approximately $290 million.
That second mint is the part worth sitting with. It was not opportunism against an unpatched system. PlayDapp knew it had been robbed, had publicly acknowledged it, had offered to pay, and the attacker came back anyway through the same door. Whatever fix went in after February 9 did not close the path, and the negotiation the team was counting on turned out to be a conversation only one side was having.
With the tokens uncontainable and the contract compromised, PlayDapp took the only structural option available. It paused the PLA contract permanently and migrated the entire token to a new one, swapping PLA for a newly issued PDA at 1:1 for legitimate holders. The minted supply was stranded on a contract nobody would honour.
That migration is what makes the headline figure slippery. The attacker minted $290 million of notional value and could never realise anything close to it, because 1.79 billion tokens dumped into PLA's liquidity would have collapsed the price long before they cleared. The real extraction was a fraction of the headline. What the $290 million measures accurately is the size of the hole in the contract, not the size of the withdrawal.
The tokens were never recovered. Nobody has been identified. There is no known arrest and no attribution to any group, state-backed or otherwise. PlayDapp's own tracing efforts went nowhere, and the funds remain unaccounted for.
The lesson is narrow and repeats constantly in this database. A mint function is not a normal function. Anything that can create supply out of nothing needs its permission checks treated as the highest-severity code in the system, because a bug there is not a theft of what you hold, it is a theft of what your token is worth to everyone who holds it. PlayDapp's holders were not robbed of a treasury. They were robbed of the assumption that the supply they bought into was fixed.
The Aftermath
PlayDapp permanently retired the compromised PLA contract and migrated legitimate holders to a new PDA token at a 1:1 ratio, which protected holders from the inflated supply but did nothing to recover the stolen tokens. No attacker has been identified and no arrest has been reported. The $1 million bounty was never claimed. The minted tokens remain unaccounted for, though the great majority were never realisable at the prices used to headline the loss.
COMMENTS