Worked example · 2021-05

Meebits — the mint told you what you got before you had to keep it, and an archived attribute file told you what it was worth, so a contract minted and reverted until a rare one came out — Meebits / Larva Labs (Ethereum) — 2021-05-08

Loss: no assets were stolen and no contract was compromised. The measurable transfer is the market value of the rarity captured: an ultra-rare Meebit minted through the exploit sold on OpenSea for 200 ETH (~$700K–765K). The attacker publicly claimed an anticipated extraction rate of "$300,000 per hour" for as long as the window stayed open. The victims are the buyers who paid mint price and secondary prices for a distribution they believed was a fair lottery; that loss is real, distributed, and not denominated anywhere. Contemporary coverage framed it against the collection's ~$85M valuation at the time.
OAK Techniques observed: OAK-T12.007 (Mint-Outcome Reroll / Revert-Until-Rare — primary, confirmed mechanism, and the canonical anchor for the Technique. Both preconditions of the class were present: the minted token's identity was knowable inside the minting transaction, and an archived file carrying per-tokenId characteristics made that identity immediately scoreable for rarity. An attacker-deployed contract minted, compared the returned Meebit ID against its rarity list, and reverted the entire transaction whenever the result fell below a threshold — so an unfavourable draw cost only gas. See techniques/T12.007-mint-outcome-reroll-revert-until-rare.md). No T5.x extraction Technique applies, and the absence is the point: nothing left anyone's wallet. OAK-T12.002 (Fake-Mint / Counterfeit Collection) explicitly does not apply — the minted Meebit was entirely genuine, issued by the real contract, and remains valid today.
Attribution: pseudonymous, and self-declared. The operator identified themselves publicly as 0xNietzsche and discussed the technique on Twitter while it was running, including the "$300,000 per hour" claim. No legal action, no identification, and no link to a tracked OAK actor. The public narration is itself a data point: the operator evidently did not regard the activity as theft, which is a defensible reading of the on-chain facts and an indefensible one of the economics.
Key teaching point: A lottery in which one participant may decline the ticket after seeing it is not a lottery — it is a search, and everyone else is paying search costs they were never told about. The Meebits contract was not broken. The randomness was not compromised. Every Meebit minted was legitimate. What failed was the sequencing: the outcome became knowable to the minter before the minter was committed to it, and EVM atomicity turned "knowable" into "rejectable" for the price of gas. The fix that the ecosystem converged on within a year is delayed reveal — assign token IDs at mint, bind attributes only after the window closes, from a seed nobody could have predicted during minting. If rarity is unknowable at mint time there is nothing to filter on, and the entire class disappears. Two secondary lessons carry weight beyond NFTs. First, the attribute file was the enabling artefact, not the contract — an archived, reachable per-token characteristics list turned a sound contract into an exploitable one, which is a reminder that supporting data is part of the attack surface. Second, the on-chain evidence of this attack is reverted transactions, an artefact class that costs the attacker almost nothing, that most tooling de-emphasises, and that nobody archives — so the detection signal that matters (revert-rate by sender during the mint window) is only available while the mint is actually running.

Summary

Meebits is a 20,000-item 3D character collection released by Larva Labs, the studio behind CryptoPunks, in May 2021. Distribution ran in two phases: free claims for existing CryptoPunk and Autoglyph holders, followed by a community mint.

The minting path allowed a caller to learn the identity of the token it had just minted within the same transaction. Separately, an archived file containing the characteristics of each token ID was reachable, which meant a returned ID could be scored for rarity immediately rather than after a reveal.

On 2021-05-08, an attacker combined the two. Their contract called mint, checked the returned Meebit ID against a rarity list, and — if the result did not clear a chosen rarity score — reverted the transaction, discarding the mint as though it had never happened and retrying. The loop cost gas per failed attempt and nothing else.

The operator, posting publicly as 0xNietzsche, teased the method on Twitter and said they expected to make "$300,000 per hour" while the window lasted. One ultra-rare Meebit produced this way sold on OpenSea for 200 ETH, reported between $700,000 and $765,000.

Larva Labs paused community minting and trading in the Meebits contract, stating that "the contract is safe, all Meebits are safe, and trading is working just fine" — accurate on its own terms, since no token or wallet was compromised. Distribution was moved to a devMint flow in which users proved ownership of their Punks or Glyphs through a form, removing the open, contract-callable mint that made the loop possible.

Timeline (UTC)

When	Event	OAK ref
2021-05-03	Meebits launches; claims for Punk / Glyph holders, then community mint	(context)
(standing)	The minted token's identity is knowable inside the mint transaction; an archived per-`tokenId` characteristics file makes it scoreable for rarity immediately	(standing T12.007 preconditions)
2021-05-08	Attacker contract loops: mint → score returned ID against rarity list → revert if below threshold → retry	T12.007
2021-05-08	0xNietzsche narrates the technique publicly and claims an anticipated "$300,000 per hour"	(self-disclosure)
2021-05-08 onward	An ultra-rare Meebit produced via the loop sells on OpenSea for 200 ETH (~$700K–765K)	(value realisation)
2021-05-08 onward	Larva Labs pauses community minting and trading; states the contract and all Meebits are safe	M34
post-event	Distribution moves to a `devMint` flow gated on proof of Punk / Glyph ownership, closing the open contract-callable mint	(remediation)
2021 → 2022	Delayed-reveal becomes near-universal practice across NFT launches, designing the precondition away	(ecosystem response)

What defenders observed

Pre-event (the precondition is a design property, checkable before launch). Ask two questions of any issuance mechanic: can the minter learn the outcome inside the transaction? and can the outcome be priced at that moment? If both answers are yes, the collection is exposed regardless of the quality of its randomness (M16).
Pre-event (supporting data is attack surface). The archived characteristics file — not the contract — supplied the scoring function. Enumerable IPFS directories, sequential metadata URIs, build artefacts, and repository history should all be treated as pre-reveal disclosure risks.
Pre-event (delayed reveal is the fix, and it is structural). Binding attributes after the mint window from an unpredictable seed removes the filter target entirely. Commit-reveal minting achieves the same by separating the transaction that requests from the transaction that delivers.
At-event (revert-rate by sender is the live signal). The loop's failures are reverted transactions concentrated on a handful of senders. Grouping mint calls by sender and alerting on failure ratio fires during the mint — the only window in which pausing still helps (M11).
At-event (contract callers are a signal, not a boundary). msg.sender != tx.origin checks are trivially bypassed from a constructor and penalise smart-contract wallets. Report on it; do not rely on it.
Post-event (rarity concentration is the durable evidence). Even with no mempool monitoring, comparing realised per-holder rarity against a fair-draw distribution detects the outcome after the fact — the check that a project can still run months later.
Response (pause worked; the framing did not). "The contract is safe" was true and beside the point. When the defect is in distribution fairness rather than custody, a statement scoped to custody reads to buyers as a denial of the thing that actually happened.

Public references

[cointelegraphmeebits2021] — Cointelegraph, "$85 million 'Meebits' NFT project exploited; attacker nabs $700,000 collectible" (the 2021-05 dating, the ~$700K collectible, and the collection's ~$85M contemporary valuation): https://cointelegraph.com/news/85-million-meebits-nft-project-exploited-attacker-nabs-700-000-collectible
[cryptopotatomeebits2021] — CryptoPotato, "Exploit in Larva Labs Meebits NFT Makes Rare Mints Printable at Will" (the mechanism in detail: the archived file containing per-token-ID characteristics, the mint-check-revert loop against a rarity score, 0xNietzsche's "$300,000 per hour" claim, and Larva Labs' pause of community minting and trading plus the move to a devMint flow gated on Punk / Glyph ownership proof): https://cryptopotato.com/exploit-in-larva-labs-meebits-nft-makes-rare-mints-printable-at-will/
[cryptoslatemeebits2021] — CryptoSlate, "Ultra-rare Meebit NFT minted via exploit sells for $765,000" (the 200 ETH OpenSea sale and the upper reported valuation): https://cryptoslate.com/ultra-rare-meebit-nft-minted-via-exploit-sells-for-765000/
[paradigmnftlaunches2021] — Paradigm, "A Guide to Designing Effective NFT Launches" (the design literature that characterises revert-until-rare among NFT launch failure modes and sets out delayed-reveal and commit-reveal as the structural mitigations): https://www.paradigm.xyz/2021/10/a-guide-to-designing-effective-nft-launches

Discussion

Meebits is the corpus's clearest case of an attack that moves no assets and still has victims. Frameworks organised around asset movement — where did the money go, whose keys were used, which contract was drained — return nothing here. No wallet was compromised. No contract misbehaved. The tokens are genuine and the sale was voluntary. What was taken was the fairness of a distribution, which is exactly the property buyers were paying a premium for, and it was taken before any of them could participate on the terms advertised. OAK files it as a Technique because the mechanism is repeatable, the preconditions are checkable in advance, and the mitigation is known — which is the whole test — and because a taxonomy that only recognises drains will keep missing this entire family.

The class also illustrates how atomicity is a security property with two signs. Transaction atomicity is normally protective: partial execution cannot leave inconsistent state. Here the same property lets an attacker decline an outcome after observing it, converting a probabilistic issuance into a filtered search. Anywhere a protocol reveals a valuable result to the party who can still abort — mint rarity, loot-box contents, gacha pulls, randomised airdrop tiers, on-chain generative outputs — that inversion applies. The fix is never "better randomness"; it is separating revelation from commitment.

Finally, the ecosystem response is worth recording as a rare, clean success. Delayed reveal went from an unusual design choice in early 2021 to standard practice within roughly a year, and the technique retired because its precondition was designed out of the launch pattern rather than because anyone stopped trying it. That is the strongest possible outcome for a Technique page, and it sets the bar for what "solved" should mean elsewhere in the corpus. It also sets up the standing warning in the Technique's own discussion: novel issuance designs keep re-introducing atomic knowability, and each new mechanic — hybrid fungible/non-fungible standards, on-chain generative reveals, redemption paths that pay out by item — deserves the two-question check before launch rather than after.