Notice on the November 12 Security Incident and Extended Maintenance

Hello, Maplers.

 

The service maintenance that began on November 12 at 04:43 (UTC) and concluded later that night was carried out in response to unauthorized external access to MSU's off-chain server infrastructure.

 

We apologize for the delay in sharing this update, as well as the inconvenience it has caused. This time was needed to accurately verify the facts and the full scope of the impact, and to carry out the necessary measures accordingly.

 

We appreciate your patience, and would like to share what we have confirmed so far and the measures we have taken.

 

 

1. What Happened

  • On November 12, we confirmed that an unauthorized external party had accessed part of MSU's off-chain server infrastructure. Based on what we have confirmed so far, the blockchain and smart contracts were not affected.
  • We blocked the access path immediately upon discovery, and placed all services under maintenance from November 12, 04:43 (UTC) to prevent further impact.

 

2. No Impact on Assets

  • After reviewing on-chain records and service operation wallets, we found that no assets were moved or stolen as a result of this incident.
  • Users' wallet private keys are held only by the users themselves and are never transmitted to or stored in MSU’s systems. Therefore, they were not among the data accessed in this incident.

 

3. Service Operation Keys and Contract Permissions

  • The operational private keys that can move assets are stored in encrypted form and were not exposed. All attempts to access the key management system required to decrypt them were blocked.
  • There has also been no change to our smart contract permission settings. Accordingly, there has been no change in token supply, which can be verified through the on-chain records.
  • Even so, as a precautionary measure, we have replaced all operation keys with new ones before resuming our services.

 

4. Information Accessed (Confirmed So Far)

Based on what we have confirmed so far, the information below was accessed for some users, and this may change as the investigation continues.

Among users who have registered an email address with MSU, we will contact those who may have been affected separately by email. The information confirmed to have been accessed by an unauthorized party is the following, from records dated after 23:26 (UTC) on November 4, 2026.

  • Account information: Wallet address, nickname, profile image, sign-up time, last login time, and country/city of last access
  • Login history: Login time, IP address, country/city, device and browser information, and session key
  • Email information: First 12 characters of email address
  • Linked social account information: Service type (e.g., Discord), username, and user ID
  • OpenAPI usage records: Wallet address, IP address, app ID, call path, and request/response content
  • Shop terms consent records: Wallet address, purchase ID, terms type, and consent time
  • Transaction and service activity records: Token transfers, marketplace trades, notifications, in-game item, currency, and character changes, each with the related wallet addresses included in each record

Which items apply to each user depends on their activity during this period and the information they registered with MSU, such as an email address or a linked social account.

 

[For Builders]

  • App information registered in the Builder Center was also accessed for 328 apps. This includes builder wallet address, nickname, API key, and OAuth client ID.
  • We have confirmed that the exposed API keys cannot be used to affect assets.
  • We will help buidlers reissue their API keys and will share instructions separately.

The records confirmed to have been accessed so far do not include real names, phone numbers, physical addresses, KYC information, or payment card information.

We will share any further findings on the MapleStory Universe website and the official X account.

 

5. What this may mean for you

  • These records link a wallet address to a nickname, an IP address, an approximate location (country and city), and device information, and for some users to part of an email address or a linked social account. Someone holding them could connect a wallet’s public on-chain activity to that information.
  • They could also be used to send phishing or impersonation messages that look credible, by email or through linked social accounts.

 

6. Security Measures Taken

  • We have blocked the path used in the attack and revoked all access credentials confirmed to have been obtained by the attacker. All subsequent attempts to reuse those credentials were denied.
  • The affected servers have been replaced with new servers.

 

7. What We Ask of Our Users

  • Based on what we have confirmed so far, there is no need to change your wallet or move your assets.
  • MSU will never ask for your private key or seed phrase under any circumstances. Please be cautious of emails, messages, and websites impersonating MSU using leaked email addresses, wallet addresses, nicknames, or social account names.
  • Do not connect your wallet or sign transactions on any websites you reach through links in emails or messages related to this incident.
  • Please check our official announcements through the MapleStory Universe website and our official X account.

 

8. Interim measures for the game

  • Entry to Chaos Gloom is currently restricted. We plan to open it over the weekend and will announce the exact time through a separate notice.
  • We apologize for the inconvenience caused by the extended maintenance. For eligibility and how to claim the maintenance compensation, please refer to the Notice on Delayed Maintenance Compensation - Nov 11 Patch.

 

9. Inquiries

 

 

We apologize once again for the inconvenience, and we appreciate your patience and understanding.