METAMASK

DESCRIPTION OF EVENTS

"Hey guys, I'm Yoda" "So, like, I'm not a rich guy, by any means, like. Any of you who know me, I'm like. I've just been grinding. I suck a little bit. I'm a like, I'm I'm just umm, a little goofy out there in the space. I'm not some, I'm not Pranksy. You know, I'm not Carlini. Uhh, I'm not that level of awesome. I will be. No, I I'm joking. Uhh, I would like to be, one day."

"So, man I have all my seed phrases memorized. I thought that was a good thing. Having it memorized means I can import from, recover from, anywhere. Where if you don't memorize it, you got to go in your safe and grab that. Which, I thought I was playing it safer memorizing it."

"So, just wanted to explain what happened, umm, because I'm sure things will make their rounds and people will talk [negatively] and "You know, oh he's - Yeah listen, I'm an idiot, uh, like, this is all my fault. Let me get that out of the way. Uhh, I don't blame anybody. This is all on me. Umm, and, the crazy thing is, when it happened, the best way I can describe it - let me tell you what happened."

"Umm, I was at work. Uhh. I always keep my discord up just to kind of keep up to date and, umm, I was just in Bored Ape Yacht Club announcements, like, just in there, just like catching up on things. And, I switched over to another tab and I saw, umm, the Bored Ape Yacht Club icon. And, umm, you know, it had like the, the badge. Like, you know where I was, where there was one thing, umm, new in there. So I clicked on it, and I was thinking, that I was in the Bored Ape Yacht Club announcement tab. I didn't even realize I was in a DM because I just saw the Bored Ape Yacht Club icon and I thought, I would, I had just been in there like 20-30 seconds prior so."

"I clicked on it. It said they were doing a giveaway. To be honest with you, I remember the giveaway saying like "Hey, we're giving away", I don't know, "10 or 12 apes." And I thought with the Christie's auction, that hey, like, there's nothing to say that the apes can't be given away. Apes, they do do that sort of thing I thought. Or, people do giveaways. So, I clicked on it, took me to the Bored Ape Yacht Club website, and the thing is this. I have recently done a couple giveaways, uhh, through Discord, where you have to connect your wallet in order to, uh like- You you do, like like a signature, from your wallet, in order to sign up for the giveaways. So, umm, I thought that's what I was doing."

"And, I think when I clicked on the button it automatically brought up a MetaMask screen saying that I was compromised. And it didn't just, umm, it wasn't exactly like what the MetaMask extension looks like. It was, it it was almost like I was taken to the MetaMask website. And I was like "Oh [that sucks], my account's compromised." Like, literally that was the first thought I had, was my MetaMask was compromised. Umm, and it, you know, it had the seed phrase to import it, and and two fields for the password."

"Umm, so, I started entering it in. I think I maybe mispelled a couple words, and. I entered it in. I think I entered my password, once, in, like in one of the fields. Then you have to verify it, umm, for a second time."

"As I started typing it a second time, it's like I keep, I keep replaying this in my mind how it happened. And it was simple. My my fingers were like 5 seconds faster than my brain. Because, umm, I never clicked the Next button. I felt like "Wait a second". It like clicked in my mind "Don't enter your seed phrase". This this has to be a scam."

"Literally exited out of the screen and was like "Oh my gosh, thank [you]." I'd literally almost just gave up my seed phrase and my password. [It's a big deal.] Umm... Was relieved. Was like genuinely relieved, went into the Ape's Discord to just say like "Hey isn't - this is like a scam, right?" and they're like "Yeah, don't click on it." I'm like "I clicked on it." Uhh, I'm like, "But luckily, like I didn't go all the way through." And they're like "Did you enter in your seed phrase?". I'm like "Yeah, but I never clicked Next." They're like "Yeah, you could be compromised. It could be keylogged." Never heard of keylogged. I'm not a techie guy. Uhh, I'm a flooring guy. So, umm, hadn't heard of that. Felt sick. Like, I'm at work, it's busy, and I'm like "Oh [Gosh], he's getting... like let me look for my ape because that's the first thing that's going to be gone." Go into my wallet, search my ape, ape's gone." "Oh [this sucks]."

"Umm, and at that moment in time, I'm like, uhh, I I used to be in the service. I used to be in the US military and I kind of went into like, like just, checklists. The problem is, I didn't really have a checklist because I'm not a techie guy. I just was, like "Oh [Gosh], checklist, step 1, what [on Earth] am I supposed to do?" Umm, I remembered back to the Fuck Render hack, and I remember reading the thead and I remember reading that MetaMask helped Fuck Render like, uhh, move things, uhh, to a secure wallet. The most valuable items first. So I'm like "Okay, cool, first thing I gotta do." Or, it wasn't MetaMask that helped. It was, I think, OpenSea. So I'm like "I gotta get OpenSea. They can lock this [stuff] down. And, and, so I'm like franticly trying to get ahold of OpenSea. I let my group know. The idiots. I let the idiots know, uhh, what was going on. And, umm, really I'm like, I'm just gonna sit here and watch this guy drain me."

"I moved out my Genesis Comics. That was the next thing I searched for. I have one of them. I moved him out. I had enough, uh, ethereum in my wallet to move him out, and a valuable stoner cap. I moved them to a second wallet. The problem is he cleared out my ethereum, so uh, I was only able to move 2 things. So, at that moment, I'm like "Okay, he's got my Ape. Umm, I've moved out 2 things. But, like, what's next?" I have no idea what this guy's capable of doing. Then, what I wasn't prepared for, was that this guy. Keep in mind, I'm at like zero - 0.0001 maybe in my wallet. Umm. This guy starts sending in ethereum to cover the gas fees to send things out. Was not ready for that."

"Umm, and actually I, what ended up happening is I was getting head, like a heads up from people in the Ape discord who were literally checking Etherscan, umm, like "Hey, incoming." And then I would wait for money to come in, so I could kick it back out. Umm, and so, like somebody out there randomly got, it must have been somebody I did a transaction with, randomly got, some small transactions yesterday and was probably like "What is this coming from?". That was me just selecting, copy and pasting, a wallet that was in in like recent transactions, that I was just trying to boot his money back out to. And then finally, uhh Hudah from CryptoSlam was like "Hey, send it to me." Umm, I'm like "Yeah, I should be sending this to somebody I know." Keep in mind this hacker dude was like quick, quick, quick. Money comes in, he could transfer things out. I wasn't able to boot it every time. I just wasn't able to save everything. Umm, because he was fast. And, like, I guess let's say uhh, I'm probably, maybe moderate speed at best. This dude was fast. So it was like, it's like I'm on the track with Usain Bolt. I really had no chance. Umm, but I will tell you this. This is kind of how I was able to save some things. Hudah sat on the phone with me for 3 hours and lots of idiots helped out, sent ethereum, uhh to him, so he could send it to me in small increments, so we could bundle things together, umm, and sell them for 0.0001 on a private listing on OpenSea. So I was able to save some stuff doing that."

"Umm, I was doo..., I I think it was 3 hours of, like, I don't want to say fighting this guy, but that's what, that's really what it was. It was like, I I had to shut my store down. It was, like, defense mode of him sending in, me trying to kick it out, trying to salvage what I could. And then after 3 hours, the guy DMs me. And, umm, he asks for - he said "Hey, do you have any emotional ties to any of your pieces?" And I'm like "Yeah, like the reason I'm not much of a flipper is because I have emotional ties to all of my [stuff]." Umm, which makes me a terrible flipper. Like, yeah, I I I do, but they're all gone. I didn't realize he was the hacker. I just thought he was some dude who was wondering like "Are you emotionally tied to your stuff?" umm. And he said "You can pick, uh, one thing to have back." And I was like "Oh man". Like I'm actually grateful that the dude let me pick one thing because we all know he did not have to let me have anything. And I was like "Are you, are you being for real?" And he said "Yeah". Umm, he let me have one thing back. And then Hudah said "Ask him if you can have one other thing." Umm, because it was a gift of Punks Comics and, I I asked him that. I said "Hey, like, could I have one more thing?" And he said, uhh, and he, and I asked for one comic. And he said "Yeah, one comic". I'm like "Okay". He was going to give me back my dog, my Bored Ape Kennel, uhh uhh uhh Bored Ape Kennel Club. But, he got kicked out of the Ape's Discord, and once that happened, he got [upset] and he said, uhh, he wasn't giving it back. So, umm, we chatted back and forth a little. He was my ... he he he was the teacher who was teaching me the lesson of not being [dumb]. And he said, like, "Hold your Ape tight." Umm, what else did he say? "Hold your Ape tight." And, you know, let this be a lesson. Which, obviously, it was. And, uhh, I said "Is this over?" And he said "Yes". So I was like "Okay. Cool. It's over.".

"Uhh, it's not over because, this morning, he's still, uhh, plucking things from my account. I was able, he left 0.05 in so I was able to transfer, uhh, some Purrnelope's Country Club. Umm, by the way, Purrnelope's Country Club sold out last night. Awesome. I was so hoping he wasn't going to take my cats. So hoping... Because I knew that project was going to take off. So, he didn't take my Purrnelope's Country Club kitties. I think I got 20 of them out. I think I had 21 or 22. I got, I got, I got all but 2 out." "I was taken for 35-50 ETH." "Lost around 110k. [A]wful."

"Umm, he took my NFT box and stuff. I mean look, listen. If you guys want to know the total loot he took. Uhh, I know it's this much. An Art Blocks Lightbeam, uhh six- five PUNKS Comics, 6 Mint Passes. Of those comics, two of them were the uhh DAO vaults. Umm, the DAO tokens. So, Art Blocks took, uhh Art Blocks, five comics, 6 Mint Passes. Uhhhhh, I don't want to say this. Five beautiful grape baby Kongz. It sucks. I love those little guys. Umm, I was able to save Henry the Grape. Got him. That was the first guy I transferred. But, he took my bebes. He took 'em. I hope somebody's going to be good to them. So he got those Kongz, Comics, Art Blocks, NFTBox, loot. I was able to move my XCOPYs. And XCOPY, thank you, dude. That was, like, in the middle of all of going through all that, XCOPY reached out. I just thought that was awesome."

"Umm, what else did he get? Uhhh, I'm not thinking of stuff right now. But I know he. Oh, he got my Jenkins Yacht. That was for my Ape to be in the book. That was gonna be kind of cool I thought. He stole, well all actually, Jenkins Yacht, 3 Jenkins stands, umm, some Wicked Craniums. I'm missing some other high value stuff, but I think when we total it up, 35, 40 ETH, worth of stuff he took. Umm, so, you know what, I guess the part I'm looking at is I'm super grateful that I got the stuff that I did. I think we saved 60 worth of stuff - 60 ETH worth of stuff."

"Umm, I was able to save my super rare piece from David Beyonkee. So that was cool. Umm, a couple moon cats. But anyway, I just, I just wanted to give a huge thank you to everybody that helped. A heartfelt legitimate thank you. Uhh, top of the list. Hudah, MVP, and you non-fungible idiots in our group. You guys are awesome. Umm, Ebos, Measly, Joe, you guys sent the money over to help get transactions out. Like literally everybody who checked in with me, in with me yesterday. You guys are amazing. So, uhh, okay. Lesson learned. To anybody watching this, don't. Uhhh, man, you hear it all the time, and you know, don't click on [stuff]. Don't don't enter your seed phrase into anything. Even if you don't click the Next button, they can still take it. So, umm, anyway. Ohh, dude, you know what they got. All my NFTGuild skulls. I was, I was missing something. I'm like "Man, there's something else really good they took."

"Umm, the community was amazing, and, like, seriously, umm thank you, all, like all of you. Vell, Hudah, Beasly, Joe, ummm man and Bucky. Like, I'm just going to miss a ton of people who just even just reached out to me. Uhh. And I'm going to tell you like, in the moment where you're getting all of your [stuff] stolen, there's something like a little bit comforting in, like, people, umm, you didn't feel like you were on an island. I didn't feel like I was on an island. Like, people were reaching out. Everybody like, total strangers, NFT friends from across the world, like just reaching out. "What can I do? How can I help?" and umm, that was probably the best part of yesterday even though yesterday was just incredibly stupid."

"Oh well. Hey, I'll be back guys. I will be back. I'll be back in the guild. Hey. It's all good, man. Uhh, if this is the worst of days, I guess it's still a good day because there's a lot of people out there I know legitimately suffering in ways that are so much worse than losing, umm, beautiful pictures of beautiful awesome art, and monkeys, and baby apes, and little kitties. I get it man. I have perspective."

"I'm blessed, uhh, you guys are all blessed if you're watching this video. Even if you get wrecked like me, we're not crossing the Rio Grande barefoot hoping to make it to the US to make 7 bucks an hour or 3 bucks an hour. We we we've got it pretty good. So I'm trying to keep that in perspective. I spent, umm, I spent a lot of time in my earlier career seeing people suffering. So, like, this is not suffering, okay. This is not suffering. So, alright guys. That's it. I've gone on for 15 minutes and 57 seconds. So, hope you guys have an awesome day and, uhh, bless you all. Bye."

An NFT collector who goes by the name Yoda was tricked into revealing their private key seed phrase via a discord scam. While they didn't click "Next", the key was still entered into a live website. A significant quantity of NFTs were taken, however this was less than half of the NFTs present in their account at the time. They published a video describing their ordeal. It appears that they have accepted the loss and are not pursuing the thief further.

HOW COULD THIS HAVE BEEN PREVENTED?

The primary issue was that their seed phrase was provider to an attack website. Any content entered on a website should be considered insecure. Never enter any sensitive information on a website other than the official website for a service. There should never be any reason to enter your seed phrase on any website if you are storing cryptocurrency securely.

Check Our Framework For Safe Secure Exchange Platforms

If you want to join me in watching metamask account get robbed by some asshole look below : CryptoCurrency (Jul 3)
If you want to join me in watching metamask account get robbed by some asshole look below : CryptoCurrency (Jul 5)
__Shazbot__ comments on An apology thread to u/007happyguy (Sep 15)
If you want to join me in watching metamask account get robbed by some asshole look below : CryptoCurrency (Sep 15)
here's what happened - YouTube (Sep 15)
Henry the Grape | Council of Kongz (@HenryTheGrape): "Here is a summary of what happened yesterday during the @BoredApeYC phishing scam. Thank you to everyone that helped. @Hudah_Idiot @landock2 @yojyo333 @EbbosNFTs @XCOPYART #nonfungi...itter (Sep 15)
Hudah (@Hudah_Idiot): "is your head still spinning from yesterday? mine sure as hell is. happy to help. ill always be there for you and that goes to the entire community. you can trust me and you can trust the entire cast of Idiots."|nitter (Sep 17)
Purrnelope's Country Club (Sep 19)
https://www.jenkinsthevalet.com/ (Sep 19)
The Wicked Craniums (Sep 19)
art blocks (Sep 19)
PUNKS Comic (Sep 19)
TheMintPass (Sep 19)
NFTBoxes (Sep 19)
https://xcopy.art/ (Sep 19)
https://opensea.io/collection/genesis-comics-ip (Sep 19)
Carlini Interview: The Growth of NFT Boxes – Floor is Rising NFT Podcast (Sep 19)

More case studies

Poly Network
Validation Error

Dao Maker
Exploit