At 12:43 p.m. on November 12, Nexon's blockchain game MapleStory Universe went offline across the board. The company said on X that some off-chain servers had been accessed without authorization and that it was investigating. The service was suspended.

The on-chain side was unaffected: the blockchain and smart contracts were not impacted, no assets were transferred from on-chain records or operational wallets, and wallet private keys had not been uploaded to their systems.

But the data that was taken wasn't on-chain. The attackers obtained some user records from after 7:26 a.m. on November 5, including wallet addresses, nicknames, profile pictures, login histories, the first half of email addresses, linked social media accounts, and transaction records for in-game items and tokens. Real names, phone numbers, home addresses, identity verification information, and bank card details were not leaked. They also accessed all 328 apps registered in the developer center. API keys were exposed, but the company said they could not be used to access users' assets.

The timeline is what’s most concerning: they got in on the morning of November 5, and it wasn’t discovered until noon on November 12—seven days in between. They’ve switched to a new server and revoked the credentials. Things can’t be restored until all the keys have been rotated, and they haven’t said how long that will take.

Don’t confuse this with what happened to Keplr last week. That was an issue with Web3Auth’s login service, and Keplr’s login went down as a result. This time, someone broke into one of its own off-chain servers. The blockchain wasn’t compromised; the game login and website servers were.

For everyday users, there are three practical takeaways. First, on-chain security doesn’t mean a project is secure. Even if the contracts have no vulnerabilities, someone can still sit inside a server for seven days. Wallet addresses, login records, and the first half of an email address can be pieced together to build profiles and run phishing scams. Second, over the next few days, don’t click emails, DMs, or recovery links from anyone claiming to be official. Wait for an official recovery announcement. Third, don’t use the same email address and social accounts for your game account as you do for your wallet. The less that leaks, the better—and a whole bundle leaking is even worse.

Xiaokai’s take: just because no money was lost doesn’t mean everything’s fine. Once data leaks, phishing gets much easier, and over the next few days, impersonators will be even more active than the hackers.

Do you use the same email address for your game account and your wallet?

#MapleStory #链游安全 #数据泄露 #Cybersecurity

— Xiaokai, a Web3 retail investor

This content is for sharing personal opinions only and does not constitute investment advice. Please make your own judgments.