Major hack on play-to-earn crypto games a ‘matter of time’

According to a cybersecurity auditing firm, GameFi projects are putting “profits above security” and pose a great risk to the projects and its users.

“Unsatisfactory” cybersecurity measures among play-to-earn (P2E) crypto games pose a great risk to GameFi projects and their gamers alike, warns blockchain cybersecurity auditor Hacken.

In an Aug. 1 report shared with Cointelegraph, Hacken said that data indicates that Gaming Finance (GameFi) projects, the category which P2E games would fall under, often “put profits above security” by releasing products without taking appropriate precautions against hackers.

“GameFi projects […] do not follow even the most essential cybersecurity recommendations, leaving malicious actors numerous entry points for attacks.”

P2E games often incorporate nonfungible tokens (NFTs) in their ecosystems in addition to crypto. The largest projects, such as Axie Infinity (AXS) and Stepn (GMT) use a wide array of products designed to enhance the gaming experience, such as token bridges, blockchain networks, or physical merchandise.

Hacken researchers found that based on data collected by crypto security ranking service CER.live., there were severe deficiencies in GameFi cybersecurity in particular. It found that out of 31 GameFi tokens studied, none received the top security ranking AAA, while 16 received the worst D score.

Rankings for each project were determined by weighting various aspects of their cybersecurity, such as token audits, whether they have a bug bounty and insurance, and if the team is public.

Hacken’s report explained that GameFi projects typically scored low as it found that no P2E projects had insurance coverage which could help projects recover funds immediately in the instance of a hack.

The lack of insurance is partially confirmed by crypto insurance firm InsurAce’s chief marketing officer Dan Thomson, who told Cointelegraph on Thursday that it was not covering any P2E projects.

The report also found that only two projects have an active bug bounty program in place. Axie Infinity and Aavegotchi have bug bounties that award monetary compensation to white hat hackers for finding bugs in the project’s code.

Finally, it found that while 14 projects have received a token audit, only five have completed a platform audit which could find potential security holes in the project’s entire ecosystem. These include Aavegotchi, The Sandbox, Radio Caca, Alien Worlds, and DeFi Kingdoms.

The report also pointed to token bridges as a vulnerability for P2E games. Axie Infinity’s Ronin token bridge was the site of one of the crypto industry’s largest hacks ever when it lost over $600 million in tokens in March.

As P2E games grow in popularity, there will likely be an increase in the number of security exploits and dollar value stolen from projects, said Hacken. The firm has advised gamers to perform their own security check of projects before sinking a large sum of money into them.

“And, of course, keep in mind that investing in P2Es remains a potentially profitable but quite risky affair.”

On Aug. 3, crypto analyst Miles Deutscher asked rhetorically where the next crypto security concern may come from. Deutscher may have his answer.

We went from:

> Meme coins not being safe
> DeFi ponzis not being safe
> Stablecoins not being safe
> Top 10 L1s not being safe
> Bridges not being safe
> CEXs not being safe
> Wallets not being safe

What’s next..

— Miles Deutscher (@milesdeutscher) August 4, 2022