by 0xbc02db030361121dd43bbb2fcbcb4f9f98c1dc7d (Builderman#dc7d)
Immediate Request to Freeze Decentraland Names and Related Transactions
Over 1,000 Decentraland Names were stolen directly from user accounts. I call for an immediate investigation and, where technically and legally possible, an immediate freeze or suspension of all Decentraland Name smart-contract activity, affected accounts, and related transactions to prevent further losses and unauthorized transfers.
This matter requires urgent attention to protect users and preserve evidence while the incident is investigated.
These hacking incidents are becoming increasingly sophisticated.
At the moment, there doesn’t seem to be anything in place to properly support users when something like this happens. My previous experience with the bounty program showed me how difficult it can be to reach someone with the right knowledge, experience, and judgment to handle these situations effectively.
At the same time, stolen assets are still being freely bought, sold, transferred, and used by members of the community, which only makes the situation more concerning.
I’m not sure what can be done or whether there is a process in place for this, but time is critical right now.
Deploy a new NAME contract seeded from a snapshot taken at block X before the theft, then modify Decentraland applications to treat that new contract as authoritative.
Migrate the ecosystem to a new contract with additional protections such as freezing or recovery controls. (that would be the ideal scenario to help the future of the platform)
Its been mentioned by the white hats that this is a Payment Processor v2 contract vulnerability and that all you need to do is the revoke the permissions, not a collections contract issue. Unfortunately that PP v2 contract isn’t pausable on Limit Break’s end. Basically all NFTs are affected so long as you’ve given permission when using ME.
DCL can launch a new contract and issue a new set of NAMEs but if the wallet is still vulnerable with permissions still enabled there’s no point, those names will still get drained.
Also, sorry to hear you lost your names. I hope kolonel is your wallet at least? Saw those transactions
Jason, and everyone affected by the recent hack, I am truly sorry - this is a devastating situation.
I voted No, but not lightly. My concern is that this would set a dangerous and irreversible precedent. The exploit did not compromise any of Decentraland’s own contracts; it exploited the outdated approvals on Magic Eden. If we decide to rewind ownership on the basis of an external marketplace failure, I believe it would become extremely difficult to draw a clear line for any potential future incidents.
I wish everyone hit by this a fast and fair recovery.