His video game was hacked and destroyed for the 'lulz'

This is a story about what happens when a video game goes viral by accident, and what happens afterward.

It's the story of a hacker who decided to break that video game "for the lulz".

It's the story of Chris Johnson, an Australian developer burdened with the failure of a game he wanted to succeed, and troubled by the unexpected success of a video game he made on a whim.

This is the story of Moirai and the man who created it.

Moirai: a short game about secrecy, violence and murder. Created by Chris Johnson (and a small team including Brad Barrett, John Oestmann and Catherine Moore), Moirai was a simple game by most standards, a lo-fi experiment about choices. A networked experience that linked you to the previous player in unique, interesting ways. You didn't just play Moirai, you helped shape it. In Moirai, players could define the experience of the person who played next by leaving messages within the game world.

Moirai was innovative, Moirai was brilliant, but Moirai wasn't meantto succeed. It was a side project, created in tandem with a project Johnson had high hopes for.

Expand is the video game that was meant to succeed. Unlike Moirai, Expand was a ponderous, all-consuming project that would steal years of Johnson's life, not to mention his savings. It would drain every ounce of his reserves. It would leave him bruised and (by his own admission) cynical about the games industry as a whole.

Expand was released on Sept. 30, 2015. It was brilliant: meditative, innovative, polished. Beautifully made. It reviewed positively.

But Expand was a commercial failure.

Ironically it was Moirai -- the game Johnson worked on flippantly during Expand's intense, drawn-out development -- that was successful. Until one hacker decided to break it.

It was a simple hack. A vulnerability Johnson was fully aware of, he just didn't have time to fix it.

"Why didn't you contact me privately about this?"
"bc i thought it was funny"

"For the lulz eh"

"you bet my man"

The man covered in blood

Moirai is bizarre and unnerving.

You find yourself in a cave in search of a missing person. Inside, you stumble upon a man covered in blood. You have a choice: kill the man or let him pass unharmed. You ask three questions:

"Why do you have blood on your overalls?"

"Why do you have a knife?"

"I heard moans, what have you done?"

The man answers. The answers are unique. Sometimes weird. Depending on who played last they could be strange, funny or flat out bizarre.

You journey deeper into the cave. You find the skeleton of a small child and later the child's mother, minutes from death. Now you are covered in blood. You leave the cave. You stumble across a farmer. He is your mirror image. He is you ten minutes ago. He asks you the same questions:

"Why do you have blood on your overalls?"

"Why do you have a knife?"

"I heard moans, what have you done?"

You answer. You literally type those answers on a keyboard. You write whatever the hell you like.

And those responses make up the dialogue the next player sees when playing Moirai. In the beginning you were the investigator. Now you are the "murderer," hands bloodied. The cycle continues.

The crash

"Oh geez, I fucked up. I really think I've fucked this one up."

August 2016. 2 a.m. on a Sunday morning. Johnson is frantically messaging his friend. That friend is Matt Trobbiani, quite possibly the only human being in his contact list who understands precisely what he's going through.

A lot has happened since Johnson started working on Moirai. To begin with, Johnson built Moirai. In 2013 he released Moirai on a number of websites designed for developers to share their work online. A soft launch for a side project he didn't take too seriously.

In the early days Moirai was the kind of game other developers talked about.

"Have you heard of Moirai?" Johnson once asked a group of developers, when asked what he had worked on.
"Oh my god!"

Yes, they'd heard of it. They adored it.

Being creator of Moirai granted Johnson superstar status among the handful of people who played it.

"It felt really reassuring," says Johnson.

That reassurance would be transitory. In September 2015 Johnson would release Expand in a launch that would leave him wrestling with failure in the commercial video game space.

Making matters worse, Matt Trobbiani -- one of Johnson's closest friends, the man he called at 2 a.m. on a Sunday morning -- released a small game called Hacknet. He released it roughly one month before Johnson released Expand. Hacknet was an instant, dramatic hit in all the ways that Expand wasn't. It sold hundreds of thousands of copies. It made Trobbiani financially independent, and a minor celebrity in the Australian development scene.

Two opposite ends of the spectrum in tight proximity. It spoke to the random elements indie developers have to traverse in order to succeed. Expand fails where Hacknet succeeds beyond its creator's wildest dreams. What did Johnson do wrong? What did Trobbiani do differently? It's almost impossible to say.

Johnson wasn't jealous of Trobbiani's success, his resentment was directed elsewhere: At the games industry, at the way video games were sold, specifically on Steam. As the world's biggest distributor of PC video games, Steam has a massive amount of control over what succeeds and what fails. The algorithms Steam uses to make those decisions often leave developers stranded. At least, that's how Johnson felt.

So in July 2016, nearly a year after Expand's failed launch, Johnson decided to upload Moirai to Steam.

At nearly three years old, Moirai was a distant memory at this point, but Johnson had a point to make: About how games are sold on Steam, how interesting games are left drowning in the deluge of mediocrity that is Steam's overactive release calendar. 

With Moirai, Johnson wanted to challenge the system, to challenge players. So he uploaded it. And there it sat, until the day Steam decided it was fit for launch.

Moirai was free. It cost nothing to download and play. Because of that, Johnson knew there was potential for a small amount of success. He set himself modest goals of 40,000 playthroughs and a handful of positive reviews.

He got a lot more than that.

"I didn't expect the kind of response I got," says Johnson. Almost instantly Moirai exploded in popularity. Within a day it was the number one video game on Steam. An avalanche of interest. A tidal wave.

Great news, right? Not exactly.

"It was fucking awful."

Johnson was utterly unprepared for Moirai's overwhelming success. Being an online project that required storage and server implementation, Johnson hadn't planned for the scale Moirai required now that hundreds of thousands of people were trying to play the game at once. Moirai had received roughly 40,000 playthroughs on other websites prior to the Steam launch and the servers had held up. Johnson couldn't have predicted or prepared for the onslaught.

Moirai's database crashed. Almost instantly. And Johnson, who was spending Saturday with his family, was blissfully unaware until he arrived home later that night. In that short space of time Moirai had gone from receiving glowing reviews from every corner of the internet to being called an email scam. All in a short 24 hour period.

That's why, at 2 a.m. on a Sunday morning, Johnson messaged his good friend Matt Trobbiani. At that precise point in time Trobbiani, having experienced the same "success" with Hacknet, was the only person who could possibly understand what Johnson was going through.

"Oh geez, I fucked up. I really think I've fucked this one up."

Just the beginning

Trobbiani was the port in the storm.

The first thing Trobbiani said: "What can we do to get this shit back up?"

Trobbiani claims he was nothing but a sounding board. Johnson disagrees.

"His encouragement really helped," says Johnson. "He put me in a different mind-set. I was like, 'OK, we can do this thing.'"

Together Trobbiani and Johnson got Moirai working again. More servers, more outlay. But Moirai teetered on the edge. Continual issues.

Players were supposed to get an email after they played, but it was a disaster. Email queues didn't resolve, or they resolvedbut players got three emails instead of one. Moirai's database grew to such a size that Johnson had to routinely empty the server just to keep it functional. To this day, Johnson has no real idea how many people have played Moirai. He can verify at least 500,000 downloads, but the number could be higher.

Server issues were just the beginning.

Post Moirai's success, people were aggressively targeting Johnson's video game for reasons he still doesn't fully comprehend. It began with a few friendly emails -- fellow developers pointing out exploitable flaws in Moirai's database. One of the biggest misconceptions about game development, says Johnson, is that creators aren't aware of flaws in their own system. Usually it's a time or resource issue. Regardless, Johnson made fixes in response to some of the friendlier complaints.

"FAGGOT FAGGOT FAGGOT"

That was one of the less friendly complaints.  

Things were about to get weird.

The flood

The hack that took down Moirai was simple. Just some lines of code, a simple script designed to flood Moirai's database, to make it look as though thousands upon thousands of players had played Moirai when they actually hadn't.

Johnson was on his lunch break when he first saw it, a thread on Moirai's Steam Forum: "Someone's Trying to Ruin the game." Confused, he checked Moirai's database. What the hell? 20,000 new entries on the game's database. How? By the time Johnson ran and executed his own script to remove the entries there were 1,000 more on the database.

Five minutes later, Moirai's database collapsed. It quickly became obvious what was happening. This was a calculated attempt to destroy Moirai from the inside out.

The entries flooding Moirai's database referenced a username, and that username was a link to a YouTube page. Weird. On the "about" page: multiple references to Johnson. The YouTube page linked through to a Twitter account littered with posts about Johnson -- about the failure of Expand, about his abilities as a developer. Derogatory tweets aimed at Johnson specifically. It was almost like the person who hacked Moirai was leaving a trail.

The situation escalated.

The hacker pasted the script he used to destroy Moirai's Database directly onto the Steam forums. Now anyone could flood Moirai and break Johnson's video game at will.

"Fuck."

Yes, I'm looking for attention

A week earlier, around the time Johnson began receiving emails about Moirai and its vulnerabilities, he had taken a walk with his partner to de-stress.

"You know this game is free, right?" she said. "You're not making any money from it.

"You still have to work your normal job, then you're a wreck. At what point do you stop?"

Back then Johnson made a decision. He would continue hosting the servers for Moirai, keep the game up for free on Steam, but he'd take it down the minute anyone exploited Moirai's vulnerabilities.

When Moirai was hacked, Johnson kept his own promise. With immediate effect, he took Moirai down, left a note on the Steam page. Enough was enough.

And that's when the message appeared on Steam chat.

"hello"

Johnson recognised the username. 

It was the same person who posted the script on his forums, the script used to take down Moirai's servers. The same person who had hacked and destroyed Moirai.

He had tracked Johnson down and messaged him directly.

Johnson replied.

"You looking for attention?" Johnson prodded.

A pause.
"Yes, I'm looking for attention."

Johnson was baffled. He asked the only question he could think to ask at that point.

"What did you think of the game?"

And in this Steam chat they continued to message one another. Strangely. Cautiously. Back and forth as though nothing had happened. Like this person hadn't destroyed years of work on a bizarre, selfish whim. Johnson remembers it vividly: the person who hacked his video game typed like a child.

Would he attack the game again, Johnson asked, if he decided to put it back up? "No", came the reply. Johnson had already banned the hacker from Moirai's Steam forum. He had no way to publicly gloat about the "victory."

No remorse. No apology. Nothing.
"I'm a game developer too," the hacker said, finally. "You should play my game sometime."

What have you done?

Moirai is gone now. You can't play it. Chris Johnson completely removed the game from all platforms, including itch.io and Gamejolt, where Moirai was initially soft launched.

In the beginning Johnson left a message: "Moirai is no longer available to play. Thanks for taking an interest in our little game." But now that Valve has officially removed Moirai from the Steam store, even that's gone.

All that's left are the experiences of those who played. The YouTube "Let's Play" videos, of which there are hundreds. The forum threads where people shared their experiences; screencaps of the weird, bizarre user-created responses players found during playthroughs of the game.

It's oddly fitting: Moirai looked and felt like an urban legend. A strange horror story relayed on forums and subreddits, a worn-out VCR. It seems strange in hindsight to imagine Moirai as something someone might actually play.

Chris Johnson made no money from Moirai. If anything he lost money trying to salvage servers obliterated by the tremendous amount of people trying to play his strange little side project. Now Johnson has lived through both sides of the spectrum, through failure and "success". Neither managed to beat him down.

Johnson doesn't see himself as a pity case -- and he isn't. Post Expand, post Moirai, he remains active in the Adelaide indie development scene. He's still making video games. He recently built a mod for Hacknet, the successful game made by his close friend Matt Trobbiani.

If anything he feels sorry for the person who hacked Moirai.

"It's somewhat sad," he says, "that someone would be so destructive just to get attention."

iHate: CNET looks at how intolerance is taking over the internet.

Rebooting the Reef: CNET dives deep into how tech can help save Australia's Great Barrier Reef.