Defimon flags Enjin exploit with losses estimated at about $142,000

Defimon said it detected an exploit affecting Enjin, a Web3 gaming ecosystem development platform, with losses estimated at roughly $142,000. The issue involved Enjin’s ERC-1155 “Crypto Items,” which route transfers through item-specific adapters. According to Defimon, the attacker registered or used a malicious transfer adapter that bypassed owner approval checks. That allowed an exploit contract to call transferFrom and pull ENJ-backed items from around 52 unrelated holders’ wallets without approval. Defimon said the transfers were genuine TransferSingle events and did not require setApprovalForAll. After taking the items, the attacker called melt() on each stolen asset and redeemed the 500 ENJ backing tied to each item from the platform reserve. The disclosure outlines a mechanism-level failure in the transfer adapter flow rather than a user approval issue, based on the details provided by Defimon in its alert.