View source for Moonbirds NFT Trading Fraud

{{Case Study Under Construction}}[[File:Moonbirds.jpg|thumb|Moonbirds]]One holder of many Moonbirds NFTs, who happens to be a father with young children, was befriended by an online "trader" who later offered to purchase his NFTs. However, the "trader" directed him to use a malicious website to facilitate the trade. This website was able to steal all his NFTs (worth $1.5m) after he granted it permission.

The "trader" did not do a very good job of covering their tracks and had interacted with multiple exchange platforms previously, so their identity was likely compromised. They were requested to return the funds. There is no clear word if any NFTs were returned.

== About Moonbirds ==
Website: <ref name="moonbirds-8853" />

Video: <ref name="youtube-8855" />

"Moonbirds are more than just an avatar. They're a collection of 10,000 utility-enabled PFPs that feature a richly diverse and unique pool of rarity-powered traits. What's more, each Moonbird unlocks private club membership and additional benefits the longer you hold them. We call it nesting – because, obviously."

"Once inside, you will have exclusive access to Moonbird-related drops, Parliament meetups and IRL events, and access to upcoming PROOF projects; including the PROOF metaverse, codenamed Highrise."

"The money collected by via this Moonbirds project goes to PROOF Holdings, a True Ventures backed Web3 media company that brings together NFT artists and creators."

“We have big plans and this funding will be used solely to expand our team and launch new products — ultimately creating additional value for our community,” the project website says.

"Keith said that [someone] befriended him on Twitter weeks ago, and they sometimes spoke via DMs on the website about Moonbirds, until he offered to buy his NFTs on Tuesday night."

"29 Moonbirds were just stolen in a hack. ~750e (~$1,500,000) in value lost by clicking on a bad link."

"A Proof Collective member has fallen victim to a scam, losing 29 highly-valuable Ethereum (ETH)-based Moonbirds. According to a tweet by Cirrus on Wednesday morning, the victim lost 29 Moonbird nonfungible tokens (NFTs) worth $1.5 million after clicking a malicious link shared by a scammer."

The scammer “hacked a father of three children under 6-years-old and a wife, and took all their hard earned money for the past 38 years accrued in a few minutes," the victim said.

"The victim, who goes by Keith “Digital Ornithologist" on Twitter, told Motherboard that the hacker sent him to a phishing website set up with a smart contract, which he approved."

“On that site [the hacker] had a contract made to un-nest all my Moonbirds and move them in one swoop,” he said in an online chat, adding that at first it appeared the transactions were failing but eventually went through. 

“No words can describe the level of life altering results this has caused,” he said. “I'm a doctor that takes care of patients with end stage pain (cancer) and have done much for the web3 community to thrive and grow.”

"Sounds like the scammer linked the victim to a fake trading site and got him to sign a bad transaction. Hard wallets dont stop this. Please always be wary of what you are signing when confirming a transaction."

“The hackers tried to be more ‘stealth’ in the beginning and use a smart contract in the transaction for the victim to sign, but when they failed to operate it they resorted to using their ‘regular’ address (not a contract) convince the victim to sign again and it worked,” Tal Be’ery, who is the chief technology officer of ZenGo, a crypto wallet app, said.

"Ethereum blockchain explorer Etherscan shows the flurry of transactions from the victim’s wallet to the hacker in the last few hours. The 29 NFTs are flagged for “suspicious activity” on NFT trading platform OpenSea."

"This guy is really lucky, all of the moonbirds has been frozen so he will get them back. May this be a wise lesson."

"The wallet with the stolen birds just got airdropped this notice..."

"Please return the stolen moonbirds to the original owner. Keep 1 for compensation. If MBs are not returned by 5/25 @ 12p UTC, the police and FBI will be notified formally."

"That'll be a long shot. What moonbirds team can do is threaten to destroy the NFT he had stolen and becomes worthless. From now on, each of the stolen NFT must be watermarked by the team as STOLEN. So secondary buyers will be aware."

"The hacker’s alleged Twitter account has since been deleted."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== About P2Peers NFT Exchange ==
P2Peers gave the impression of being a simple and safe trading platform, with simple instructions for users to perform an NFT trade<ref name=":0">[https://web.archive.org/web/20220430030806/https://p2peers.io/ P2Peers Homepage Archive April 29th, 2022 9:08:06 PM MDT] (Jun 9, 2023)</ref>.<blockquote>Easily EXCHANGE your NFTs with p2peers. Simple. Safe. Reliable. Your NFT swapping platform p2peers many2many NFTs in a safe and a easy way.</blockquote>The website provided simple instructions for users on how they could complete their NFT swap<ref name=":0" />.<blockquote>Approve your NFTs.

To make swapping possible, we need to be able to transfer tokens on your behalf and only once per contract.

Propose the swap.

To propose the swap you need to select the NFTs you want to trade and fill in the counterparts address on the input field

Accept the swap.

The last step to swapping your NFTs is accepting the swap after getting an offer from the counterparty</blockquote>The website featured a logo, elaborate "roadmap" timeline of upcoming development, and requests to follow social media accounts of the exchange.

== The Reality ==
P2Peers was a fraudulent exchange platform<ref name="andehxbttwitter-8865" />, which was designed to trick the user into giving up wallet permissions. Once users approved what they thought was a simple trade, their entire wallet could be drained<ref name="andehxbttwitter-8865" /><ref name="guyincognitoilvtwitter-8861" />. Minimal information was provided on the website about who was behind the service.

The P2Peers platform was owned and operated by an individual with a shady past involving multiple previous frauds<ref name="andehxbttwitter-8865" />.

== What Happened ==
A scammer tricked multiple Moonbirds NFT holders into using a questionable NFT trading platform to sell their NFTs, which ultimately robbed them of all NFTs held in their wallets.
{| class="wikitable"
|+Key Event Timeline - Moonbirds NFT Trading Fraud
!Date
!Event
!Description
|-
|May 24th, 2022 8:59:00 PM MDT
|CirrusNFT Posts On Twitter
|The news of the attack is announced on Twitter by user CirrusNFT. They note that 29 Moonbirds were stolen and list the losses as ~750e ($1,500,000) before ending with a warning to the community<ref name="cirrusnfttwitter-8857" />.
|-
|May 24th, 2022 9:11:00 PM MDT
|Shady Platform Discussion
|CirrusNFT reports that the scam was being performed by tricking victims into using a shady exchange platform<ref name="cirrusnfttwitter-8864" />. Another user crypt0savage on Twitter forward an experience with a scammer insisting on using a shady platform for the transaction<ref name="crypt0savagetwitter-8863" />. TBD is this related?
|-
|May 24th, 2022 9:21:00 PM MDT
|Airdropping Threat Notice
|A notice is airdropped to the thief warning that "[i]f [Moonbirds] are not returned by 5/25 @ 12p UTC, the police and FBI will be notified formally.", allowing them to "[k]eep 1 for compensation", and claiming to be signed by "hoots.xyz"<ref name="nftan0ntwitter-8859" /><ref name="looksrare-8866" />.
|-
|May 25th, 2022 12:16:00 AM MDT
|Incog Shares Guide
|A tweet with more detail about the sites and scams is shared in response by Twitter user Incog<ref name="guyincognitoilvtwitter-8858" />.
|-
|May 25th, 2022 2:47:56 AM MDT
|CoinTelegraph Article
|CoinTelegraph publishes an article on the situation<ref name="cointelegraph-8862" />. TBD review. No significant changes to the article over time.
|-
|May 25th, 2022 4:00:00 AM MDT
|Warning About Trading Platform
|Another notice and analysis is shared by Twitter user Andeh<ref name="andehxbttwitter-8865" />. The trading platform used TBD review and add details.
|-
|May 25th, 2022 6:30:00 AM MDT
|Confirmed Due To Rogue Approve
|Blockchain security research manager Tal Be'ery confirms that the incident happened due to a rogue approval<ref name="talbeerysectwitter-8869" />.
|-
|May 26th, 2022
|Techsprout News Coverage
|Techsprout News published an article on the situation<ref name="thinksproutinfotech-8854" />. TBD review.
|-
|May 29th, 2022 10:23:00 AM MDT
|Referenced By Nftherder
|The incident is referenced by NFTherder in response to a post claiming "these scams are so dumb"<ref name="nftherdertwitter-9749" />.
|}

== Technical Details ==
The scam was conducted using the website p2peers.io

This is the official Tx. ➼ 

@DVincent_ (hacker) wallet is (0x7ccf) and he is now approved as the operator of the victims wallet (0x5afcab) to transfer from the Moonbirds contract. ➼ I don't have evidence on how this happened, probably an approval function on the website.

➼ He goes on to transfer 29 Moonbird NFTs from victims wallet to his in less than 5 hours. ➼ He also takes other NFT's also.

This is @Dvincent_ (hacker) NFT wallet in Debank. ➼ He has just under $700k estimated value worth of NFTs after this attack. ➼ He also has other PROOF collection NFT's from the same victim.

I couldn't find @Dvincent_ on the internet, it was too hard. ➼ I was able to lookup the <nowiki>http://p2peers.io</nowiki> website he used, and it was been involved in MANY scams. ➼ As expected, most of the owner details are hidden. ➼ We do see the registrar is <nowiki>http://sarek.fi</nowiki>

Then, I did a lookup of the <nowiki>http://sarek.fi</nowiki> domain registrar servers: ➼ This website was started in 2019. ➼ Belongs to an address in Finland. ➼ Owner is (recorded as) Sarek Oy and his telephone / mailing address is public.

➼ Both <nowiki>http://sarek.fi</nowiki> AND <nowiki>http://p2peers.io</nowiki> have been used in previous scams. ➼ I am actively searching for ways to continue this investigation but this may be a deadend until more is found.

<ref name="andehxbttwitter-8865" />

Here are some associated wallets with the hacker: ➼0xe8250Bb4eFa6D9d032f7d46393CEaE18168A6B0D ➼0x8e73fe4d5839c60847066b67ea657a67f42a0adf ➼0x6035B92fd5102b6113fE90247763e0ac22bfEF63 ➼0xBf41EFdD1b815556c2416DcF427f2e896142aa53 ➼0x29C80c2690F91A47803445c5922e76597D1DD2B6

== Total Amount Lost ==
CirrusNFT provided that a total of 29 NFTs were taken and estimated the total losses as ~750 ethereum or $1,500,000 USD. They provided a picture of some of the stolen NFTs<ref name="cirrusnfttwitter-8857" />. The thief's wallet appears to be live on the blockchain<ref name="etherscan-8867" />.

The total amount lost has been estimated at $1,500,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

CirrusNFT was one of the first to report the situation on Twitter<ref name="cirrusnfttwitter-8857" />.<blockquote>29 Moonbirds were just stolen in a hack.

~750e (~$1,500,000) in value lost by clicking on a bad link.

Sickening seeing stuff like this. Let this be a reminder to never ever click on links and to bookmark the marketplaces/trading sites that you use.</blockquote>Twitter user Ouriel had some further questions<ref name="ourielohayontwitter-8860" />.<blockquote>curious to know where he got it from ? if that hacked his private key or just swept his bir[d]s with a smart contract</blockquote>One user wanted to hunt down the perpetrator<ref name="0x22d7twitter-8868" />.<blockquote>Def not funny. Let’s hunt this guy down…</blockquote>

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
The total amount recovered is unknown.

== Ongoing Developments ==
It is likely that this individual is known to authorities and being pursued, however it is unclear to what stage any investigation would be in.
== Individual Prevention Policies ==
When trading, never use a new exchange platform without first obtaining multiple credible recommendations. Bookmark the official website of every exchange. Keep the majority of funds offline and never have more funds than necessary in your current active wallet.

{{Prevention:Individual:Question Unrealistic Profit}}

{{Prevention:Individual:Safe Smart Contract Usage}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Cryptocurrency Safety Quiz}}

{{Prevention:Platforms:Regular Audit Procedures}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Cryptocurrency Education Mandate}}

{{Prevention:Regulators:Platform Security Assessments}}

An easy list of platforms which can be used safely, and a method of handling any issues with those platforms losing assets could be provided.

{{Prevention:Regulators:Establish Industry Insurance Fund}}

{{Prevention:Regulators:End}}

== References ==
<references>
<ref name="moonbirds-8853">[https://www.moonbirds.xyz/ Moonbirds: The official PROOF PFP] (Aug 23, 2022)</ref>
<ref name="thinksproutinfotech-8854">[https://thinksproutinfotech.com/news/phishing-attack-strikes-moonbirds-nft-project-details-here/ Phishing Attack Strikes ‘Moonbirds’ NFT Project, Details Here - Techsprout News] (Aug 23, 2022)</ref>
<ref name="youtube-8855">[https://www.youtube.com/watch?v=MztCb2FJ7tg Future PROOF (edited short edition) - YouTube] (Aug 23, 2022)</ref>
<ref name="cirrusnfttwitter-8857">[https://twitter.com/CirrusNFT/status/1529296043547865088 CirrusNFT - "29 Moonbirds were just stolen in a hack." - Twitter] (Aug 23, 2022)</ref>
<ref name="guyincognitoilvtwitter-8858">[https://twitter.com/GuyIncognitoILV/status/1529345626059972608 Incog - "Here's a little of how that specific fake/scam swapsite thing works" - Twitter] (Aug 23, 2022)</ref>
<ref name="nftan0ntwitter-8859">[https://twitter.com/NFTAN0N/status/1529301532637704192 NFTAN0N - "The wallet with the stolen birds just got airdropped this notice..." - Twitter] (Aug 23, 2022)</ref>
<ref name="ourielohayontwitter-8860">[https://twitter.com/OurielOhayon/status/1529332553806667778 <nowiki>OurielOhayon - "curious to know where he got it from ? if that hacked his private key or just swept his bir[d]s with a smart contract" - Twitter</nowiki>] (Aug 23, 2022)</ref>
<ref name="guyincognitoilvtwitter-8861">[https://twitter.com/GuyIncognitoILV/status/1517044944061726720 Incog - "Don't lose your NFTs from buy/sell/trade scammers (especially fake sites). PLEASE read this, even if experienced." - Twitter] (Aug 23, 2022)</ref>
<ref name="cointelegraph-8862">[https://cointelegraph.com/news/nft-owners-reminded-to-be-vigilant-after-29-moonbirds-were-stolen-by-clicking-a-bad-link NFT owners reminded to be vigilant after 29 Moonbirds were stolen by clicking a bad link - CoinTelegraph] (Aug 23, 2022)</ref>
<ref name="crypt0savagetwitter-8863">[https://twitter.com/crypt0savage/status/1529299195043135489 @crypt0savage Twitter] (Aug 23, 2022)</ref>
<ref name="cirrusnfttwitter-8864">[https://twitter.com/CirrusNFT/status/1529299194577420289 CirrusNFT - "Sounds like the scammer linked the victim to a fake trading site and got him to sign a bad transaction." - Twitter] (Aug 23, 2022)</ref>
<ref name="andehxbttwitter-8865">[https://twitter.com/andehxbt/status/1529401905990242304 andehxbt - "P2peers.io was used by scammer (@Dvincent_) today to steal 29 MOONBIRD NFTS (>$700,000 USD)." - Twitter] (Aug 23, 2022)</ref>
<ref name="looksrare-8866">[https://looksrare.org/collections/0x0217a10f9508939680fd0E1288d66Dc581021319/2#activity A hoot for you (#2) - hoots | LooksRare] (Aug 23, 2022)</ref>
<ref name="etherscan-8867">[https://etherscan.io/token/0x23581767a106ae21c074b2276d25e5c3e136a68b?a=0x5afcabcbfeed16ea120a9d3c7c52d0212dda8111 Thief's Wallet Past Moonbird Transactions - Etherscan] (Aug 23, 2022)</ref>
<ref name="0x22d7twitter-8868">[https://twitter.com/0x22d7/status/1529302601052827649 0x22d7 - "Def not funny. Let’s hunt this guy down…" - Twitter] (Aug 23, 2022)</ref>
<ref name="talbeerysectwitter-8869">[https://twitter.com/TalBeerySec/status/1529439778218835969 TalBeerySec - "Rogue approve, apparently" - Twitter] (Aug 23, 2022)</ref>
<ref name="nftherdertwitter-9749">[https://twitter.com/NFTherder/status/1530947853643816962 NFTherder Reposting About Incident - Twitter] (Nov 24, 2022)</ref>
</references>