How 'MapleStory N' Is Fighting Back Against Thousands of Hackers

Avalanche massively multiplayer online role-playing game (MMORPG) MapleStory N has been inundated with bots and hackers since its massive launch in May.

Keith Kim, head of strategy at developer Nexpace—the blockchain arm of gaming giant Nexon—told Decrypt this week that thousands of accounts are being banned every day to maintain the game’s integrity for legitimate players.

Hackers, glitchers, attackers, and exploiters are common in every kind of video game—we’ve lived through the Call of Duty hacked lobby trenches. However, the stakes are notably higher in crypto games.

Some MapleStory N players have reported lobbies being filled with bots auto-farming, while another user found an abuser who solo-defeated the endgame boss in what one player called "a game-breaking flaw" in a viral X post.

Not only can a player earn real cryptocurrency in MapleStory N—by trading, grinding, and fighting—but thanks to blockchain, the malicious actors now own the items and tokens in their wallet. That means their illicit winnings have real-world value.

“It was a huge, huge issue. Internally, all of our teams were on emergency alert,” Kim said. “The number of attacks that we have been receiving for [MapleStory N] is many folds bigger than [the] entire Nexon game ecosystem combined. We have never seen such a magnitude of attack. I think it’s because there's much to be earned by doing so.”

MapleStory N is the first entry in the broader MapleStory Universe—a crypto ecosystem utilizing the two-decade-old MapleStory IP, which has a sizable following. On launch, the game prompted a 549% spike in active addresses on Avalanche, according to Nansen data, as it delivered the biggest NFT mint the network had ever seen.

Kim believes a big reason for the game’s massive number of hackers is MapleStory N’s low barrier to entry. If a hacker gets banned, then they can simply create another wallet in seconds and play the game free of charge. So, MapleStory N is looking to find the “right hurdle” that will deter hackers without putting off regular gamers in the process.

As a result, the game has implemented a 30-hour delay in cashing out assets, as this is the average timeframe that it takes for an abuser to get banned. Along with banning thousands of accounts daily, Nexpace has also strengthened its security systems and improved its abnormal play detection system.

On top of this, Nexpace has been restricting the off-ramps from its dedicated Avalanche L1 gaming network, Henesys. This means that any damage instigated by bad actors is isolated to Henesys, with no option for the abuser to fully cash out. Assuming they’re banned from the game too, the assets are rendered effectively useless.

If the hacker issue gets so bad that a large portion of an asset’s supply is held by banned abuser wallets, then Nexspace has a clawback function that allows the developers to take back the assets tied to banned accounts

“These are audited, and these are controlled by different layers of a multi-sig [wallet]. These are very, very hard to trigger,” Kim explained. “But when we, for example, see a volume of macro assets that are tied or frozen within the Henesys L1, we can do some housekeeping and bring this value back to the gamers. That's an option that we have.”

He added that Nexpace would ask the community first before triggering the clawback function. But for now, he said, it’s not worth considering due to the low value of assets stranded by banned players.

“Overall, when we are looking at the macro level, they’re earnings are way less than [what] they’re spending,” Kim explained.

“They actually bought XPC because they want to get into certain levels of items, so they can be efficient in being very quick within the 30 hours, and exploit the game.” He added, “But so far, their net inflow is way bigger than—I think twice bigger—than their net outflow. So we don't really have a lot of damages there.”

Edited by Andrew Hayward