New gacha game takes gambling to a whole new level by accidentally charging purchases to random people's PayPal accounts

What's better than spending your money gambling for waifus? Someone else using your PayPal to gamble for their waifus.

Okay, wait, actually no. That's worse. Erm.

But surely that would never happen, right? Well, for a few unlucky players diving into the launch of new gacha game Arknights: Endfield, it's exactly what happened. Endfield users have found their PayPal accounts getting charged for other players' purchases, leading developer Hypergryph to temporarily halt PayPal transactions. Meanwhile, I'm over here trying to figure out how something like this is even possible in the first place.

Taking a gander over at the official Arknights: Endfield Discord server and it seems like the issue was noted fairly early on into the game's launch as one member posted: "im getting other peoples accounts for paypal???" before warning other people to disconnect their PayPal payment from the game entirely just 20 minutes later.

1.3k Euro from r/Endfield

Screenshots began to crop up of PayPal statements showing multiple charges from Hypergryph in multiple different currencies. "All I purchased was the monthly pass for 7.34 CAD yet was charged 108 CAD in a different currency after," another user reported on the server. One Discord screenshot showed their account charged in US dollars, Canadian dollars, Japanese yen, and euros across 10 different purchases.

One of the top posts on the game's subreddit right now shows one user who was charged €1,302 by someone making a purchase in Japan. They reported that they were refunded about four hours later—so a quick resolution, thankfully, but certainly not one that should even have to happen in the first place.

The top comment on that Reddit post asks "Is this the biggest gacha oopsie in years?" I gotta say… yeah, I sure think so. Gacha games have suffered all sorts of launch and update woes over the years, but one thing you can usually rely on is the cash shop being airtight. I'm struggling to think of any other gacha that has ended up with such a huge security issue like this, and I imagine it's the last thing Hypergryph would've wanted to deal with on launch day.

As of writing, PayPal payments are still disabled. Hypergryph says on the game's official X account that it "began issuing full refunds for all PayPal orders" created between around 1:30am UTC and 3:05am UTC and those should be completed later today (Jan 22). No word on whether purchased goods will also be revoked, or whether a small number of cheeky players who likely took advantage of the exploit will be walking away with their riches intact.

"Providing a stable and reliable service is a top priority for us," Hypergryph said. "Data security is foundational to our services and a core priority for Gryphline. The PayPal payment option will remain disabled and will only be re-enabled after the issue has been fully resolved and thoroughly tested."