2022 SearchBlox incident

The 2022 SearchBlox Incident was the compromising of over 200,000 accounts that had their Robux and limiteds stolen due to a third-party Roblox extension available on the Chrome Web Store. This compromising incident was organized by LucentWaves.
== Background ==
First published to the Chrome Web Store on August 2, 2020, SearchBlox was originally a Roblox extension used to join users in experiences by bypassing the user's privacy settings. This allowed its users to join whoever they desired, in many cases popular Roblox content creators. Many content creators did not approve of this plugin because of its potential to disrupting recordings or livestreams, or allowing users to stalk others. However, some content creators, such as , did not mind this occurring as long as it did not disrupt recordings.
Due to the amount of backlash it has received, on March 18, 2021, the plugin was removed from the Chrome Web Store. However, the plugin was once again available on the Chrome Web Store the following day.
When it was the start of the SearchBlox history, figures out it has been posted by a member on the now defunct Roblox exploiting forum called v3rmillion.
== Compromising ==
On November 22, 2022, the creator of SearchBlox, fripp, pushed an update for the SearchBlox extension and removed the repository containing the extension's source code from their GitHub account. Later that day, a large amount of users posted on Twitter that most of their Robux and limiteds were missing from their accounts, which many players suspected was because of the SearchBlox extension. , a popular content creator who had the SearchBlox plugin installed along with multiple other extensions, posted later in the day that he had purchased a T-shirt without his knowledge earlier in the day, causing him to lose all of his Robux. An investigation by MyUsernamesThis found that the plugin had been updated with a backdoor to execute arbitrary JavaScript code into the user's browser, which created a T-shirt that matched the amount of Robux that the user had on their account; the user would then purchase the T-shirt using API endpoints. An analysis of the malicious code also found functions that enabled trading on the victim's account if the user had Roblox Premium, and then sent trade requests to the hijacker's account to steal the user's most valuable items.
Users quickly determined that the limiteds stolen through were being transferred to a newly created account named , which was being used as a holding account to
There was common misconception created by users that the user "ccfont" was involved in the theft. However, it was quickly pointed out that ccfont was one of the victims of the SearchBlox compromise, and due to 2FA being activated, Lucent couldn't easily take the items away off his account, so he gave placeholder items in exchange for ccfont's items and traded back and forth, causing the rumors. , was the 13th richest user on the platform at the time of the incident. Many users and news accounts then began warning users to uninstall the SearchBlox extension to prevent further item loss.
== Aftermath ==
A few hours after reports of Robux being stolen began surfacing on Twitter, the accounts associated with the incident were terminated, as well as the group used to store stolen Robux being locked. On November 23, 2022, Google removed SearchBlox from the Chrome Web Store, and Roblox began restoring Robux and items lost by users affected by the incident.
Ccfont was also never able to obtain his account back even though he was falsely accused of stealing accounts.
== See also ==
* KreekCraft video on the incident ("200,000 Roblox Accounts Just Got Hacked...")
* Chaseroony video on the incident ("Roblox Is ACTUALLY Being HACKED RIGHT NOW...")
== References ==
Category:Incidents