Liskgame.com markets itself as an online cloud generator or exploit injector. It targets players of popular mobile and multiplayer games (such as Roblox , Fortnite , Brawl Stars , or Coin Master ), claiming it can inject premium currencies into a user's account with just a few clicks.
The exploit scenario, as documented in the security report, was alarmingly straightforward: "Alice, a regular user, has 10000 LSK tokens allocated to her account. Eve fetches Alice's merkle proof from the off-chain application and submits it to the claimMultisigAccount function, she sets her own address as the recipient and provides zero values for the keys and sigs input parameters. Since the signature verification is skipped and the proof is valid, Eve receives all of Alice's allocated LSK tokens. Eve repeats this action for all regular users, stealing most of the LSK allocation". liskgamecom hack
: Downloading "hack tools" often installs spyware or ransomware on your device. Legitimate Lisk Gaming Context Liskgame
Covering tracks
Before examining the security incidents, it is important to understand Lisk's fundamental architecture. Launched in 2016, Lisk is a blockchain application platform that allows developers to build decentralized applications using JavaScript, one of the world's most accessible programming languages. Unlike monolithic blockchains such as Ethereum, Lisk employs a modular architecture where each application runs on its own sidechain connected to the main Lisk network via a Delegated Proof of Stake consensus mechanism. In this system, network security relies on delegates who are voted into positions of trust, ensuring that only relatively trusted participants can validate transactions and produce blocks. Eve fetches Alice's merkle proof from the off-chain