On Sunday, the world was rocked by a scandal that shook the foundations of the video game community. During a competitive esports tournament for Apex Legends, a popular free-to-play shooter game, hackers managed to infiltrate the games of two well-known streamers, effectively cheating mid-game.
“Wait, what the fuck? I’m getting hacked, I’m getting hacked bro, I’m getting hacked,” exclaimed one of the players during the live stream of the gameplay.
As a result, the organizers of the Apex Legends Global Series, which boasts a total prize pool of $5 million, were forced to indefinitely postpone the event “due to compromised competitive integrity.”
During the mid-game hacks, the chatbot within the game displayed messages onscreen claiming to be from the hackers: “Apex hacking global series, by Destroyer2009 &R4andom”.
In an interview with TechCrunch, the self-proclaimed hacker Destroyer2009 took credit for the hacks, stating that his actions were “just for fun” and with the intention of forcing the developers to fix a vulnerability he had discovered.
The hacks sent the Apex Legends community into a frenzy, with countless streamers reacting to the incidents and some players questioning the game’s safety. Many feared not only getting hacked during gameplay but potentially having their entire computers hacked as well.
Destroyer2009 refused to provide specific details on how he allegedly pulled off the hacks during the tournament, only revealing that the vulnerability “had nothing to do with the server” and that he never accessed anything outside of the Apex process. He also claimed that he did not directly hack the players’ computers.
“I really don’t want to go into the details until everything is fully patched and everything goes back to normal,” the hacker stated.
When asked about why he didn’t report the vulnerability to the game’s developer, Respawn, Destroyer2009 explained that neither Respawn nor the game’s publisher, Electronic Arts, offer a bug bounty program that rewards hackers for privately reporting security flaws.
“They know how to patch it without anyone reporting it to them,” Destroyer2009 remarked.
Defending his actions, Destroyer2009 stated that he had no malicious intentions and that his goal was simply to gain attention and “go viral.” He also mentioned that he specifically targeted the two players, Geburten and ImperialHal, because “they’re just nice guys” and he wanted to “give them free attention and views.” (Neither of the players responded to numerous requests for comment.)
On Tuesday, Respawn (the developers of Apex Legends) posted a statement on X (formerly Twitter) regarding the incidents.
“Our teams have deployed the first of a layered series of updates to protect the Apex Legends player community and create a secure experience for everyone,” the statement read, though it did not provide any details regarding the update or what exactly happened on Sunday.
Conor Ford, a member of the Apex Legends security team, addressed the incidents on X as well, expressing his team’s efforts to address the issues and praising his colleagues for their talent and dedication.
In an attempt to ease public concern, Destroyer2009 asserted that “players shouldn’t worry” because he doubts others will figure out the vulnerability he used before it gets patched.
Despite the attention his hacks garnered, neither Respawn nor Electronic Arts offered a response to requests for comment from TechCrunch about Destroyer2009’s claims or allegations.
Easy Anti-Cheat, the developers of the anti-cheat engine used in Apex Legends, also released a statement on Monday claiming they were “confident that there is no RCE vulnerability within EAC being exploited.” Remote code execution (RCE) is a security flaw that allows hackers to run malicious code on a target’s device, potentially giving them direct access to the target’s computer.
At this time, there is no public evidence that suggests an RCE was involved in Sunday’s hacks.
To those concerned about the safety of the game, Destroyer2009 reassured players that they need not worry, as he believes no one else will be able to exploit the vulnerability before it gets patched.
Do you have information about this hack or other video game hacking incidents? Contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram, Keybase, and Wire @lorenzofb, or through email. You can also reach out to TechCrunch via SecureDrop.
