PlayDapp: Hacker Ignored a $1M Bounty and Minted $290M of Tokens

On Friday 9 February 2024, a wallet nobody at PlayDapp recognised created 200 million new PLA tokens out of thin air and sent them to itself. PlayDapp, a South Korean company that ran a marketplace where gamers trade in-game items, had never authorised it. At the market price that morning the new tokens were worth about $36.5 million.

The next day PlayDapp wrote to the thief in the only way it could: a message attached to a transaction on the blockchain, the public ledger every holder can read. It offered a $1 million "white hat" reward, the industry's term for a fee paid to a hacker who hands the money back, if the tokens were returned by 13 February. It also said it would go to the FBI. The thief did not reply. On 12 February the same wallet printed another 1.59 billion PLA, worth $253.9 million at the price of the day.

Across the two raids the attacker created about 1.79 billion tokens. At pre-attack prices that came to roughly $290 million, the figure that went round the world in headlines. The number was real in one sense and fiction in another, and the gap between the two is the most useful thing about this story.

A company, a token and a printing press

PlayDapp was founded in Seoul in 2017 by Sung-Wone Choi and sold itself as a home for blockchain games: players could buy, sell and swap items such as characters and skins across several titles. Its currency was PLA, a token on the Ethereum blockchain, which works much like a share in the project that trades on crypto exchanges around the clock. PLA was listed on Upbit and Bithumb, the two biggest exchanges in South Korea, and on Binance, the biggest in the world.

A token like PLA lives inside a smart contract, a piece of code that moves money by itself according to fixed rules. One of those rules decides who may "mint", meaning create new tokens. Minting is the crypto version of a company issuing new shares: done properly it is rare, approved and disclosed. Done improperly it dilutes every existing holder, because the same pie is cut into more slices.

PlayDapp's contract kept a list of addresses allowed to mint. Blockchain security firm Halborn said an access control flaw let the attacker "add themselves as an official minter", in other words write their own name onto the list of people allowed to run the printing press. PeckShield, another security firm, and Elliptic, a blockchain analytics company, both said the likeliest route in was a leaked or stolen private key, the password that proves ownership of a wallet, belonging to an account with power over the contract. PlayDapp never published who held that key or how it escaped.

Why the $290 million was never really there

Before the attack there were about 577 million PLA in circulation, according to Elliptic. The thief created roughly three times that. Imagine someone forging three times a company's entire share count and then trying to sell it on the stock exchange: the price would collapse long before most of the paper found a buyer. Elliptic made exactly that point at the time, warning that the attacker would struggle to trade the tokens "for anything near their previous market value".

Molly White's Web3 Is Going Just Great tracker went further, noting that the $290 million headline was more than two and a half times PLA's own claimed market value. BleepingComputer, which had run the $290 million figure in its first headline, later changed it to describe tokens minted rather than money stolen.

What the thief actually cashed out has never been confirmed. Elliptic reported that the tokens were already "beginning to be laundered", moving to exchanges and other accounts. PlayDapp asked exchanges to freeze the wallets and asked decentralised trading pools, automated markets where anyone can swap one token for another, to stop handling PLA. PLA fell from about $0.18 to $0.14 in the first days, and lost most of its value over the following weeks. Some of the tokens were dumped before the freezes landed. No firm or official body has ever put a verified dollar figure on how much.

The second raid

The detail that makes this case stand out is the return visit. By 12 February PlayDapp knew it had been robbed, had said so in public, had moved its own reserve of tokens to a new wallet and had paused the PLA contract. The attacker still got back in and minted eight times as much as the first time. Whatever PlayDapp locked after the first raid, it did not lock the door the thief was using.

The bounty was the other half of the lesson. Offering a reward has become standard practice after a crypto hack, and it sometimes works: in other cases, attackers have returned most of the money in exchange for a cut. But it only works when the thief needs the deal more than the loot. Here the thief had a working printing press, and the offer of $1 million against a notional $36.5 million was answered with another $253.9 million.

The migration, and the delistings

With the old contract compromised, PlayDapp did the only thing left: it abandoned PLA. The company took a snapshot of who held what before the attack and swapped legitimate holders into a new token, PDA, one for one. The new contract, PlayDapp told Korean exchanges, used multi-signature control, meaning several people must approve a sensitive action, like a bank cheque needing two signatures, and had its minting power removed altogether. The thief's tokens were left behind on a contract nobody honoured.

Binance closed its PLA markets on 26 February 2024 and opened PDA trading on 1 March. The Korean exchanges were less forgiving. Upbit and Bithumb, both members of DAXA, the Digital Asset eXchange Alliance through which South Korea's main exchanges coordinate listings, had put PLA on a caution list on 13 February. On 11 March 2024 they announced they would end trading support for PDA altogether, despite the security changes and a relief fund PlayDapp said it had set up. Trading on Upbit stopped on 25 March 2024. For a Korean gaming token, losing its home exchanges was close to a death sentence.

Binance followed a year later. On 24 April 2025 it announced it would delist PDA along with three other small tokens, citing its routine review of trading activity and development. Spot trading ended on 2 May 2025. As of 16 October 2026, no attacker has been named, no arrest has been reported, and no recovery figure has been published. The incident has not been publicly attributed to any group.