Metawin Hack

Reported loss $4.4M
Ethereum Solana
Access Control

What happened

On November 3, 2024, an attacker exploited Metawin's frictionless withdrawal system and drained its Ethereum and Solana hot wallets of more than $4 million. Metawin temporarily disabled withdrawals, later restored access, and its CEO said affected balances had been backfilled. ZachXBT identified 115 theft addresses and reported transfers to KuCoin and a HitBTC nested service.

How it happened

  1. The attacker abused a vulnerability in Metawin's fast, low-friction withdrawal workflow.
  2. That workflow enabled unauthorized withdrawals from the Ethereum and Solana hot-wallet pools.
  3. ZachXBT associated 115 theft addresses with the event and tracked funds to KuCoin and a HitBTC nested service.
  4. Metawin paused withdrawals, restored most access, and said it replenished affected balances.

Protocol details

Classification Gaming / Metaverse / Frontend & Infrastructure
Protocol Type Exploit/Access control
Protocol links Website @meta_winners

Evidence

Understand the attack patterns

Compare incidents →
Access Control Attacks

Same attack technique

Browse all hacks →
Arbitrum Gamdom $4.2M lost Bitcoin Bitpoint $32.0M lost Ethereum Bithumb $31.0M lost Bitcoin Inputs.io $1.2M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes