A hacker recently exploited a bug in a newly launched gaming token on Blast network, Super Sushi Samurai, to steal roughly $4.6 million worth of Ethereum on March 21 — less than a month from its launch.
The exploit resulted in an approximately 99% slippage in the token’s value following an unauthorized token dump. The attacker extracted 1310 ETH from the token’s main liquidity pool by doubling their balance repeatedly and then selling it all. Super Sushi Samurai was scheduled to launch its web3 game on the same day, but the incident may have been conducted by a white hat hacker currently in touch with the Super Sushi Samurai team.
Investigations into the incident revealed that an unauthorized party acquired 690 million SSS tokens and subsequently initiated a series of transactions through an attack contract specifically designed for this purpose. By exploiting a vulnerability within the platform’s _update() function, the attacker was able to duplicate the tokens in their possession 25 times. This manipulation inflated the token quantity to 11.5 trillion, which was eventually exchanged for approximately 1,310 ETH, equivalent to around $4,590,827.
Following the breach, Super Sushi Samurai has engaged with its community, providing updates and assurances through its official Telegram channel and other social media platforms. The team said it is trying to contact the exploiter, and the most recent tweet from the gaming platform indicates a white hat hacker has reached out about the incident. The team’s communication efforts aim to keep stakeholders informed about the incident’s developments and the measures to address the security vulnerability.
This incident highlights the critical importance of robust security protocols in the crypto sector, where the digital nature of assets makes them vulnerable to such exploits. It also highlights platforms’ ongoing challenges in safeguarding against sophisticated cyber threats.
