Newly Issued Gaming Token Exploited on Blast With $4.6M Drained

The hacker attempted to contact the SSS team, stating their intention to reimburse users.

AccessTimeIconMar 21, 2024 at 4:02 p.m. UTC
Updated Mar 21, 2024 at 4:30 p.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global event for everything crypto, blockchain and Web3.Register Now
  • A total of $4.6 million was lost, according to CertiK.
  • The exploit was related to the smart contract's mint function.
  • The token lost more than 99% of its value.
  • Running With Crypto: 5 Questions With TRM Labs' Ari Redbord
    Running With Crypto: 5 Questions With TRM Labs' Ari Redbord
  • Hacks Involving North Korea Are 'Even Greater Problem': Legal Experts
    Hacks Involving North Korea Are 'Even Greater Problem': Legal Experts
  • Breaking Down the State of Hacking in 2024
    Breaking Down the State of Hacking in 2024
  • Crypto Hack Volumes Fell by More Than 50% in 2023: TRM Labs
    Crypto Hack Volumes Fell by More Than 50% in 2023: TRM Labs
  • A gaming token on layer-2 network Blast has been exploited with $4.6 million stolen less than a week after its introduction, according to an announcement in the token's Telegram channel.

    The project, named Super Sushi Samurai, released the SSS token on March 17 and had planned to start offering the game today.

    An unknown entity exploited a vulnerability in the smart contract's mint function before selling tokens directly into the SSS liquidity pool. SSS lost more than 99% of its value after sale, according to CoinGecko. Blockchain security firm CertiK said that a total of $4.6 million was affected by the exploit.

    "We have been exploited, it's mint related. We are still looking into the code. Tokens were minted and sold into the LP," the team wrote on Telegram.

    The exploiter attempted to contact the team, describing the event as a "white hat rescue" hack, in a BlastScan message. "Let's work on reimbursing users," they said.

    "We are in touch with the exploiter," the Super Sushi Samurai team wrote on X.

    Yuga Labs developer coffeexcoin wrote that the liquidity pool, a fundamental component of decentralized finance, was drained because "their token contract has a bug where transferring your entire balance to yourself doubles it."

    The Blast mainnet went live last month after receiving $2.3 billion in deposits, rapidly becoming the fourth-largest layer-2 network, with $1 billion in total value locked (TVL), DefiLlama data shows. The largest, Arbitrum One, has $4 billion TVL, according to CoinGecko data.

    UPDATE (March 21, 16:30 UTC): Adds quotes from Super Sushi Samurai team and coffeexcoin, tweet from the latter.

    Edited by Sheldon Reback.


    Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

    CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

    Oliver Knight

    Oliver Knight is a CoinDesk reporter based between London and Lisbon. He does not own any crypto.

    Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to to register and buy your pass now.

    Read more about