MapleStory Universe off-chain server breach exposes wallet-linked user data and builder API keys; no assets moved

Summary

MapleStory Universe (MSU) confirmed on 12 November 2026 unauthorized external access to part of its off-chain server infrastructure. MSU placed all services under maintenance from 04:43 UTC on 12 November and says the blockchain and smart contracts are not affected. User records dated after 23:26 UTC on 4 November 2026 were accessed.

Affected

• MapleStory Universe off-chain services (accounts, login history, OpenAPI logs, Builder Center)
• Builder Center app information for 328 apps (builder wallet address, nickname, API key, OAuth client ID)
• Fix: MSU blocked the access path, revoked the credentials obtained by the attacker, replaced affected servers, and says it will rotate all operational keys before resuming service

Impact

Per MSU, no assets were moved or stolen, no operational private key was exposed, and attempts to reach the key management system were blocked; contract permissions and token supply are unchanged. Accessed data includes: wallet address, nickname, profile image, sign-up and last-login time, last-access country and city; login history (time, IP address, location, device and browser, session key); the first 12 characters of registered email addresses; linked social account type, username and user ID; OpenAPI usage records; shop consent records; and token transfer, marketplace and in-game activity records with related wallet addresses. MSU says real names, phone numbers, physical addresses, KYC data and payment card data were not among the records confirmed accessed so far, and that exposed builder API keys cannot affect assets. MSU warns the data could be used for credible phishing or impersonation that links wallets to identities. The investigation is ongoing.

Recommended actions

• MSU users: per MSU, no wallet change or asset move is needed. MSU will never ask for a private key or seed phrase; do not connect a wallet to or sign on any site reached through an email or message about this incident.
• Builders: reissue Builder Center API keys following MSU's instructions.
• Treat unsolicited messages that quote your MSU nickname, wallet address or partial email as likely phishing.

Source & attribution

This 0xCERT advisory summarises MapleStory Universe's security notice (https://x.com/MaplestoryU/status/2120927819786309872), corroborated by SlowMist Hacked (https://hacked.slowmist.io/). Details may change; refer to the original source for the authoritative record.