View source for Monkey Kingdom Discord Hack

{{Case Study Under Construction}}{{Unattributed Sources}}

[[File:Monkeykingdom.jpg|thumb|Monkey Kingdom]]Monkey Kingdom's NFT launch was interfered with by fraudulent links, which pretended to allow users to mint NFTs for the project. The malicious links were sent from the official channel of the project. Heavy losses were taken, reportedly up to $1.3m USD.

This is a global/international case not involving a specific country.<ref name="nftnow-8532" /><ref name="redditold-11203" /><ref name="monkeykingdomtwitter-11204" /><ref name="monkeykingdom-11205" /><ref name="vanilablog-11206" /><ref name="commenstartwitter-11207" /><ref name="whois-11208" /><ref name="magiceden-11209" /><ref name="monkeykingdomtwitter-11210" /><ref name="monkeykingdomtwitter-11211" /><ref name="monkeykingdomtwitter-11212" /><ref name="cryptonews-11213" />

== About Monkey Kingdom ==
"Monkey Kingdom is one of the known “Bluechip” projects in Solana NFT space, currently sitting at 45 SOL FP, but reaching the floor price up to 100 SOL (~$18,000)."

"Monkey Kingdom's first collection (Gen 1) - 2,222 uniquely generated 32x32 pixels NFTs on the Solana Blockchain. Daily $PEACH token airdrop, staking, breeding, metaverse development and real world exclusive meet-ups and merch collabs. Gen 2 - Diamond Baepes (on Solana) Gen 3 - Monkey Legends (on Ethereum)"

"There was a scheduled party with Steve Aoki to celebrate the new minting collection."

== The Reality ==
"The[ Monkey Kingdom project] reported earlier that malicious links were spreading via DM, so they announced to not click anything except the official announcement channel."


Many fake bots exist online which attempt to gain access to the Discord accounts of cryptocurrency service administrators. These can then be used to later manage the group or post announcements.

"Once you interact with these fake bots they will snag your discord token, giving them instant access to your account without 2FA or your password."

== What Happened ==
On December 21st, 2021, "users of Solana-powered NFT projects Fractal and Monkey Kingdom faced phishing fraud via the official servers."

"[B]ut it ended up really bad." "Just before the real mint, a big hack happened over the Monkey Kingdom Solana NFT project. Over $1.2 million [was] hacked from thousands of people who tried to mint and some individuals are reporting that they lost 650 SOL (~$100,000)."

{| class="wikitable"
|+Key Event Timeline - Monkey Kingdom Discord Hack
!Date
!Event
!Description
|-
|December 21st, 2021 12:08:05 PM MST
|Reddit Discussion
|News of the incident was shared on Reddit<ref name="redditold-11214" />. Community reactions to the incident varied. Some community members clarify that this wasn't a hack but rather a scam. Others discuss the technical details of how the scam occurred. Concerns were raised about Discord bots being compromised, with some speculating that it could be an inside job. Community members stress the importance of using burner wallets for minting NFTs. There was a debate about personal responsibility, with some suggesting that users should exercise caution and double-check links before proceeding. Some community members express sympathy for the victims and recommend using hardware wallets for securing significant cryptocurrency holdings. Overall, the community emphasizes the need for better security practices and awareness to prevent similar scams.
|}

== Technical Details ==


"[B]ut it ended up really bad." "Just before the real mint, a big hack happened over the Monkey Kingdom Solana NFT project. Over $1.2 million [was] hacked from thousands of people who tried to mint and some individuals are reporting that they lost 650 SOL (~$100,000)."


"This seems like a well-planned attack." "[It] seems that [a] malicious bot sent an official announcement with a malicious link, which looked exactly like the original website." "[T]he malicious bot sent the announcement from the official channel, and people were rushing like crazy to be the first one to mint. They also reported a DDOS attack on their website, which made it unavailable, just before the mint."


== Total Amount Lost ==
"Over 7,000 SOL ($1.2 million) got lost." "According to a report, hackers were able to steal crypto worth $150,000 and $1.3 million from Fractal and Monkey Kingdom NFT holders, respectively."

The total amount lost has been estimated at $1,300,000 USD.

== Immediate Reactions ==
The issue was also discussed on Reddit.

=== Reddit Discussion Thread ===
The incident was shared in Reddit<ref name="redditold-11214" />. Community reactions to the incident varied.

# Some community members clarify that this wasn't a hack but rather a scam, highlighting that the victims believed they were sending money to the real mint but were deceived.
# Others discuss the technical details of how the scam occurred, explaining that a scammer posted a fake mint link on the official Monkey Kingdom Discord server, leading users to approve a sweeper contract that drained their wallets.
# Concerns are raised about Discord bots being compromised, with some speculating that it could be an inside job.
# Community members stress the importance of using burner wallets for minting NFTs and interacting with suspicious websites to prevent such incidents.
# There's a debate about personal responsibility, with some suggesting that users should exercise caution and double-check links before proceeding.
# Some community members express sympathy for the victims and recommend using hardware wallets for securing significant cryptocurrency holdings.
# Overall, the community emphasizes the need for better security practices and awareness to prevent similar scams in the future.


"This seems like a well-planned attack." "[It] seems that [a] malicious bot sent an official announcement with a malicious link, which looked exactly like the original website." "[T]he malicious bot sent the announcement from the official channel, and people were rushing like crazy to be the first one to mint. They also reported a DDOS attack on their website, which made it unavailable, just before the mint."

"Since minting such a big project is a race of fast fingers, a lot of people didn’t pay attention to what is going on. The website asked for permission from a Phantom wallet, and it actually drained all SOL from their wallet."


"Guys I got drained 650 $SOL. It is one my biggest mistake. I am always recommending people using burner but I was nervous and fomo the Monkey Kingdom Mint. Never thought it was not a legit mint link in official discord. It is important money to my family: my wife, my son."


"The[ Monkey Kingdom team] are investigating with Discord developers what happened, and also said they will make it up to all victims, but let's see what will happen."

== Ultimate Outcome ==

=== Investigation With Discord Developers ===
"The[ Monkey Kingdom team] are investigating with Discord developers what happened, and also said they will make it up to all victims, but let's see what will happen."

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

== Ongoing Developments ==
TBD
== Individual Prevention Policies ==
The primary issue is around approval of the malicious transaction. While the announcement was in the official Discord channel, it directed users to a malicious a non-official website. Furthermore, the specific transaction was malicious and drained funds from wallets.

{{Prevention:Individuals:Double Check Transactions}}

{{Prevention:Individuals:Safe Smart Contract Usage}}

Losses could be massively reduced by using a separate wallet for all minting with only a small balance. Other assets and NFTs can then be transferred to cold storage for safe keeping.

{{Prevention:Individuals:Store Funds Offline}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
The primary issue was the breach of an official channel of a major NFT project. This could have been avoided with better security of the channel, which had been independently validated.

{{Prevention:Platforms:Regular Audit Procedures}}

One very effective way of setting up the Discord permissions would require multiple signatures to approve any announcements. In this way, it becomes exponentially challenging for an adversary to post a fraudulent link.

{{Prevention:Platforms:Implement Multi-Signature}}

Cryptocurrency users could also have protected themselves through better education. This can provide an understanding of the risks of fake mint phishing attacks and to double check the official URLs of all projects.

{{Prevention:Platforms:Cryptocurrency Safety Quiz}}

An industry insurance fund could assist affected users in events where an attack is still successful. While this is a discretionary process, it's likely in clear fraud events like this, all losses could be covered.

{{Prevention:Platforms:Establish Industry Insurance Fund}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
The primary issue was the breach of an official channel of a major NFT project. This could have been avoided with better security of the channel, which had been independently validated.

{{Prevention:Regulators:Platform Security Assessments}}

Cryptocurrency users could also have protected themselves through better education. This can provide an understanding of the risks of fake mint phishing attacks and to double check the official URLs of all projects.

{{Prevention:Regulators:Cryptocurrency Education Mandate}}

An industry insurance fund could assist affected users in events where an attack is still successful. While this is a discretionary process, it's likely in clear fraud events like this, all losses could be covered.

{{Prevention:Regulators:Establish Industry Insurance Fund}}

{{Prevention:Regulators:End}}

== References ==
<references>
<ref name="nftnow-8532">[https://nftnow.com/news/warning-hackers-are-targeting-discord-bots-to-rob-nft-users/ Warning: Hackers Are Targeting Discord Bots to Rob NFT Users] (Jul 16, 2022)</ref>
<ref name="redditold-11203">[https://old.reddit.com/r/solana/comments/rllpn2/over_7000_sol_12_million_got_lost_on_solana_nft/hpj8bsz/ Tradegrow comments on Over 7,000 SOL ($1.2 million) got lost on Solana NFT mint due to a hack that happened on the Discord channel] (Oct 3, 2022)</ref>
<ref name="monkeykingdomtwitter-11204">[https://twitter.com/MonkeyKingdom/status/1473312369556213769 @MonkeyKingdom Twitter] (Nov 15, 2022)</ref>
<ref name="monkeykingdom-11205">[https://monkeykingdom.io/ Monkey Kingdom️] (Nov 18, 2022)</ref>
<ref name="vanilablog-11206">[https://blog.vanila.io/over-7-000-sol-1-2-946215a9ee0e Monkey Kingdom NFT Hack - $1.2 million worth Solana got stolen | Vanila Blog] (Nov 18, 2022)</ref>
<ref name="commenstartwitter-11207">[https://twitter.com/commenstar/status/1473310287789162496 @commenstar Twitter] (Nov 18, 2022)</ref>
<ref name="whois-11208">[https://whois.domaintools.com/baepes.com Whois Lookup Captcha] (Nov 18, 2022)</ref>
<ref name="magiceden-11209">[https://magiceden.io/marketplace/monkey_kingdom Monkey Kingdom - Magic Eden] (Nov 18, 2022)</ref>
<ref name="monkeykingdomtwitter-11210">[https://twitter.com/MonkeyKingdom_/status/1473326864899141632 @MonkeyKingdom_ Twitter] (Jun 1, 2023)</ref>
<ref name="monkeykingdomtwitter-11211">[https://twitter.com/MonkeyKingdom_/status/1473331988488941568 @MonkeyKingdom_ Twitter] (Jun 1, 2023)</ref>
<ref name="monkeykingdomtwitter-11212">[https://twitter.com/MonkeyKingdom/status/1473321966237261828 @MonkeyKingdom Twitter] (Jun 1, 2023)</ref>
<ref name="cryptonews-11213">[https://cryptonews.com/news/solana-based-hacked-monkey-kingdom-phishing-lesson-for-nft-buyers.htm Solana-Based Hacked Monkey Kingdom Has a Phishing Lesson for NFT Buyers] (Jun 1, 2023)</ref>
<ref name="redditold-11214">[https://old.reddit.com/r/solana/comments/rllpn2/over_7000_sol_12_million_got_lost_on_solana_nft/ Over 7,000 SOL ($1.2 million) got lost on Solana NFT mint due to a hack that happened on the Discord channel - Solana Reddit] (Jun 2, 2023)</ref>
</references>