An idle Telegram game called Super Sushi Samurai saw its liquidity provider wallets drained for $4.6 million due to a bug that let users double their own funds.

"We have been exploited, it's mint related. We are still looking into the code. Tokens were minted and sold into the LP," said the project's official X account.

A Yuga Labs smart contract developer known as Coffee noted that the token contract had a bug. If a user transferred the entire balance of their wallet to themselves, it would double their funds.

It seems the attacker did exactly this and then used the funds to drain the liquidity on decentralized exchanges. The attacker sold the newly minted tokens for 1,310 wrapped ether, worth $4.6 million at current prices.

However, the funds may not entirely be lost. The person who …