MutantNFTs Hack

Reported loss $25K
Other

What happened

Mutant Labs, the NFT staking and token-rewards platform run by the Mutants project on Cardano, lost roughly $25K in claimable reward tokens on January 25, 2023. The attacker drained other users' unclaimed rewards between 01:00 and 06:00 UTC across 473 claim transactions.

The flaw was in Mutant Labs' reward-claim check. It treated a Cardano stake address as the user's identity. On Cardano, an address combines a payment credential (who can spend) and a stake credential (who delegates), and anyone can build a "Franken address" that pairs their own payment key with someone else's stake key. The attacker did exactly that, so the API took them for the real users and let them claim those users' rewards. Mutant Labs believes the attacker found targets by watching addresses that used its raffle and stake contracts and then querying its API for their pending rewards.

Only tokens that were available for users to claim were taken. The treasury wallet was not touched. Raffles and stakes were also unaffected, because their Plutus validator checks public key hashes rather than stake keys. Mutant Labs changed the check to identify users by payment address (the first payment address seen for a stake key), restored every user's rewards, added the stolen liquidity back to affected projects' DEX pools, and said it would return tokens to each affected project founder.

The team published a list of the exploit claim transactions: Source

How it happened

  1. The attacker looked for Mutant Labs users with unclaimed rewards, most likely by checking addresses that had used its raffle and stake contracts and then querying the Mutant Labs API.
  2. For each target, the attacker built a Franken address combining its own payment key with the victim's stake key.
  3. It submitted reward claims from those addresses. The claim check compared only stake addresses, so each claim passed as if it came from the victim.
  4. Over 473 transactions between 01:00 and 06:00 UTC, the claimed tokens went to addresses whose payment key the attacker controlled, and the attacker later moved them out.

Protocol details

Classification NFT
Protocol Type Exploit/Other
Protocol links Website @MutantNFTs

Evidence

Same attack technique

Browse all hacks →
DD coin $307K lost Unlock Protocol $38K lost Mycelium $300K lost Webaverse $4.0M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes