An attacker drained approximately 5.24 million ENJ, worth about $142,000 at recent spot prices, from Enjin’s ERC-1155 “Crypto Items” platform on Ethereum on August 25, sweeping value-backed items out of roughly 52 unrelated holder wallets and melting each one to redeem its ENJ backing from the platform reserve, according to on-chain data flagged by security monitor Defimon.
The theft cleared in a single transaction, hash 0xd4a3…2a7e, forwarded to an attacker-controlled externally owned account beginning 0x5ec1…. Enjin has not addressed the incident publicly at the time of writing.
How the adapter bypass worked
Enjin’s Crypto Items platform routes ERC-1155 transfers through a per-item transfer adapter, a design that lets creators layer custom logic on top of a standardized token interface. That flexibility is where the exploit found its opening.
The attacker registered or used a malicious adapter that omitted the standard owner-approval check, then called transferFrom(holder, attacker, 1) against wallets that had never issued setApprovalForAll, never signed a permit, and never authorized the attacker’s contract in any form. The transfers still cleared. Defimon’s alert notes that “real TransferSingle events” were produced, meaning the on-chain state changes were indistinguishable from ordinary user-initiated moves.
About 52 wallets were emptied of their Crypto Items in the same transaction.
The mint-and-melt path to cash
Enjin’s Crypto Items model, which the company built alongside the ERC-1155 standard it co-authored, pins a fixed amount of ENJ inside every minted item. Holders can call the platform’s melt() function to destroy an item and recover the ENJ that was locked into it at mint time. A dedicated reserve pays the redemption out.
Each item pulled in this exploit carried 500 ENJ of backing. The attacker invoked melt() on every one, triggering payouts from the platform reserve at 0x4e64…174e. The full net drain of roughly 5.24 million ENJ landed in the attacker’s externally owned account inside the same transaction.
The redemption mechanism did what it was designed to do. Once the attacker held the items, ownership was all the melt path required.
What monitors are pointing at
Beyond Defimon’s core finding of the missing approval check, independent monitors have flagged two contributing factors as possible technical roots, both routine risk surfaces in upgradeable smart-contract architectures.
The first is a storage-layout mismatch in adapters interacting with a Managed Delegate Proxy via DELEGATECALL. When a proxy delegatecalls into an implementation contract, the implementation writes into the proxy’s own storage; if the two contracts’ variable orderings do not line up exactly, one write can overwrite the state of a different variable entirely. Storage collision is among the most cited vulnerability patterns associated with delegatecall.
The second is a publicly accessible initialize function, the classic upgradeable-contract failure mode where a constructor-substitute intended to run once at deployment can be called again by any address afterwards, letting an attacker seed themselves as a privileged role.
Neither has been confirmed as the root cause.
Blast radius
The incident appears limited to items whose transfer routing passed through the vulnerable per-item adapter. There is no indication that Enjin’s core ERC-1155 contracts, its Substrate-based Enjin Blockchain Layer 1, or user wallets in themselves were compromised. Enjin migrated the ENJ token off Ethereum to its own chain in September 2023, but the affected Crypto Items surface here is the legacy Ethereum deployment that still holds ENJ-backed NFTs minted before that cutover.
At an ENJ spot price of about $0.027 through the day, the roughly 5.24 million ENJ drained puts the direct out-of-pocket cost at about $142,000, absorbed by the platform’s backing reserve rather than by user wallets holding ENJ itself. The users who were affected lost the NFTs they held, not their token balances.
One in a heavier week
The Enjin incident lands in a week that has already produced several higher-value security events, most of them exploiting authorization surfaces rather than novel cryptography.
Realio’s realio.fund webapp was compromised on the same day, with an attacker sweeping 124.4 million RIO across five chains for realized proceeds of roughly $234,000 against a nominal value of about $6.3 million. Morpho’s 15-minute TWAP oracle was exploited for $36.4 million in a liquidation attack a day earlier.
BounceBit shut its chain permanently on August 21 after an authorization flaw let an attacker move 286.5 million BB across nine accounts, choosing to reissue on BNB Chain from a pre-attack snapshot rather than restart the compromised Evmos-based network. Galaxy Research separately traced $115 million in losses across 8,865 addresses to a Coldcard-related exploit surface.
The common thread across all of them, the Enjin bypass included, is that flexibility purchased in one layer of a system tends to show up eventually as attack surface in the authorization layer, once nothing is checking that the caller is who the caller says they are.
What is next
The attacker’s externally owned account continues to hold the drained 5.24 million ENJ at the time of writing, with no reported exchange deposits or cross-chain movements from the address. Enjin’s official channels have not addressed the exploit.
For Crypto Items holders, the practical question is which items depended on the vulnerable adapter, and that answer sits with Enjin. Until the company confirms scope and remediation, on-chain monitoring of the attacker EOA and the platform reserve at 0x4e64…174e remains the best real-time signal that the attack surface has closed or reopened.
The Crypto Times has reached out to Enjin for comments at 09:00 UTC.
Also Read: Crypto Hacks Drain $15M in a Week as Maya, BounceBit, Sandbox & Term Labs Fall
