Karastar Hack

REPORTED LOSS $69K
Low Access Control

What happened

Quick Summary

Jul-26-2024 Abandoned Karastar project was drained for about $69k USD.

Details of the Exploit

On Jul-26-2024 Karastar GameFi contracts were drained with losses of about 120BNB.  Exploiter upgraded a few implementations and used a backdoor function for token stealing: transfer(address token, address fromUser, uint256 value).

Block Data Reference

Proxy upgrade tx:

https://bscscan.com/tx/0x289a3107…909b61

Drain TX:

https://bscscan.com/tx/0x50cc6e73…922373

Funds held by:

https://bscscan.com/address/0x2b8D9E63…F05a6A

Case & protocol details

Classification Gaming / Metaverse
Protocol Type Exploit/Access control
Affected asset / contract KARA
Official Website www.karastar.com/
Protocol Twitter/X @karastargamefi

Evidence & learning

Attack pattern

Compare incidents →
Access Control Attacks

Sources and on-chain records

Browse all hacks

Other incidents recorded with the same attack technique.

AFX $24.1M
B² Network $3.8M
Third-party SquidRouterModule $3.2M
StablR $12.8M

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes