View source for OpenSea Fake Verification Phishing Emails

{{Case Study Under Construction}}{{Unattributed Sources}}

[[File:Opensea.jpg|thumb|OpenSea]]Many users of OpenSea, one of the largest NFT marketplaces in the world, received phishing emails requesting them to click a link and complete a verification within the next couple of days, threatening an account suspension. The email was not from OpenSea, and likely attempted to steal assets or the private keys of users who complied. It is not know how many users were affected.

This is a global/international case not involving a specific country.<ref name="openseatwitter-7229" /><ref name="theverge2-6997" /><ref name="dunexyz-6998" /><ref name="opensea-6981" /><ref name="openseayoutube-6982" /><ref name="openseadocs-6983" /><ref name="openseafaq-6984" /><ref name="openseaabout-6985" /><ref name="albinjawi89twitter-7230" /><ref name="openseateamarchive-7231" /><ref name="openseateamarchive-7232" /><ref name="openseateamarchive-7233" />

== About OpenSea ==
"The world’s first and largest digital marketplace for crypto collectibles and non-fungible tokens (NFTs). Buy, sell, and discover exclusive digital items." "Discover, collect, and sell extraordinary NFTs. OpenSea is the world's first and largest NFT marketplace."

"As the first and largest marketplace for Non-Fungible Tokens and Semi-Fungible Tokens, OpenSea provides a first-in-class developer platform consisting of an API, SDK, and developer tutorials. Feel free to browse around and get acclimated with developing smart contracts and interacting with NFT data."

"Fascinated by the [CryptoKitties] movement that was forming, Devin Finzer and Alex Atallah joined early adopter communities in Discord and started talking to users. With the OpenSea beta launch in December 2017, the first open marketplace for any non-fungible token on the Ethereum blockchain was born."

"Valued at $13 billion in a recent funding round, OpenSea has become one of the most valuable companies of the NFT boom, providing a simple interface for users to list, browse, and bid on tokens without interacting directly with the blockchain."

=== OpenSea Trading Platform Migration ===
On February 27th, 2022, many OpenSea users started to receive an email instructing them that their account required verification for the new platform, and unverified accounts would be suspended.<blockquote>Dear customer,

Due to OpenSea's migration to the new trading platform, we require all of our users to verify their accounts. All unverified accounts will be suspended on Monday, February 28th, 2022.

We apologize for any inconvenience this might cause, but please keep in mind that our goal is to provide our customers with the safest and most reliable trading platform. To prevent your OpenSea account from getting suspended please verify it using the link below prior to Monday, February 28th, 2022.

Best regards, OpenSea.</blockquote>

== The Reality ==
The received emails did not originate from OpenSea. Users who would complete the verification process would have the provided information used against them.

TBD - What information was requested by the phishing attack?


Over the weekend, at least 32 users of the popular NFT trading site OpenSea fell victim to a phishing attack, resulting in the loss of approximately 254 tokens worth over $1.7 million. The attacks took place between 5PM and 8PM ET on Saturday. OpenSea CEO Devin Finzer confirmed that the attack was likely separate from the platform and resembled a traditional email phishing scheme targeted at the NFT space. The NFT transfers were technically signed off using the sellers' unique signatures, but they were tricked into filling out the information on an inconspicuous platform, similar to fake links in email phishing scams. The NFT market has faced other issues such as counterfeit digital assets and stolen art, with many artists having their works uploaded without permission. The nature of NFTs and their ownership raises questions about what should be considered a crime in this space<ref name="pcgamer-7692" />.


"We've seen some reports of users getting emails from http://openseateam.io."

"This is not an official Opensea email address.

== What Happened ==
On February 27th, 2022, many users of the OpenSea platform reported that they had been subject to a phishing attack.
{| class="wikitable"
|+Key Event Timeline - OpenSea Fake Verification Phishing Emails
!Date
!Event
!Description
|-
|October 4th, 2021 2:19:00 PM MDT
|OpenSea Publishes Tips
|OpenSea publishes a series of tips for protecting yourself from scams online<ref name="openseatwitter-7693" />.
|-
|February 20th, 2022 10:57:07 PM MST
|PCGamer Article Report
|PCGamer reports that Over the weekend, at least 32 users of the popular NFT trading site OpenSea fell victim to a phishing attack, resulting in the loss of approximately 254 tokens worth over $1.7 million. The attacks took place between 5PM and 8PM ET on Saturday. OpenSea CEO Devin Finzer confirmed that the attack was likely separate from the platform and resembled a traditional email phishing scheme targeted at the NFT space. The NFT transfers were technically signed off using the sellers' unique signatures, but they were tricked into filling out the information on an inconspicuous platform, similar to fake links in email phishing scams. The NFT market has faced other issues such as counterfeit digital assets and stolen art, with many artists having their works uploaded without permission. The nature of NFTs and their ownership raises questions about what should be considered a crime in this space<ref name="pcgamer-7692" />.
|-
|February 26th, 2022 9:16:00 PM MST
|Main Event
|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|March 3rd, 2022 7:18:05 AM MST
|CoinYuppie Article Mentions Phishing
|The phishing attack is mentioned in a CoinYuppie article<ref name="coinyuppie-7234" />.
|}

== Technical Analysis ==
TBD - Need more details on the actual phishing attack and what was shown on the phishing website.

== Total Amount Lost ==
The total amount lost is unknown.

== Immediate Reactions ==


"On February 27, OpenSea appeared again with a phishing email attack. According to OpenSea’s official social media account, it was recently discovered that some users had received emails from openseateam.io (phishing links), the platform reminding users not to click on such phishing emails."<ref name="coinyuppie-7234" />

"We've seen some reports of users getting emails from http://openseateam.io."

"This is not an official Opensea email address. Please do not click on this email."

== Ultimate Outcome ==
TBD

"Relevant data shows that after the phishing attack, the user activity on OpenSea also dropped rapidly. Within three days of the incident, the user activity on the platform dropped by at least 20% , the transaction volume dropped by 37% within seven days , and nearly 230,000 Users left OpenSea this week."<ref name="coinyuppie-7234" />

== Total Amount Recovered ==
It is unclear if any funds were lost in this case.

== Ongoing Developments ==
TBD
== Individual Prevention Policies ==
Generally, such attacks depend on users either providing their seed phrase, installing malicious software, or approving the attackers to have access to their wallet.

{{Prevention:Individuals:Never Share Private Keys}}

{{Prevention:Individuals:Always Verify Executables}}

{{Prevention:Individuals:Double Check Transactions}}

The likelihood to receive such an email can be affected by how much personal information is available online.

{{Prevention:Individuals:Protect Personal Information}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
This issue can be prevented through better education for users. An insurance fund could be available to assist any remaining cases.

{{Prevention:Platforms:Cryptocurrency Safety Quiz}}

{{Prevention:Platforms:Establish Industry Insurance Fund}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
This issue can be prevented through better education for users. An insurance fund could be available to assist any remaining cases.

{{Prevention:Regulators:Cryptocurrency Education Mandate}}

{{Prevention:Regulators:Establish Industry Insurance Fund}}

{{Prevention:Regulators:End}}

== References ==
<references>
<ref name="openseatwitter-7229">[https://twitter.com/opensea/status/1497787591663308800 @opensea Twitter] (Mar 10, 2022)</ref>
<ref name="theverge2-6997">[https://www.theverge.com/2022/2/2/22914081/open-sea-nft-marketplace-web3-fundraising-finzer-a16z How OpenSea took over the NFT trade - The Verge] (Mar 10, 2022)</ref>
<ref name="dunexyz-6998">[https://dune.xyz/queries/37672/74639 Dune Analytics] (Mar 10, 2022)</ref>
<ref name="opensea-6981">https://opensea.io/ (Mar 9, 2022)</ref>
<ref name="openseayoutube-6982">[https://www.youtube.com/watch?v=gfGuPd1CELo Meet OpenSea | The NFT marketplace with everything for everyone - YouTube] (Mar 9, 2022)</ref>
<ref name="openseadocs-6983">https://docs.opensea.io/docs (Mar 9, 2022)</ref>
<ref name="openseafaq-6984">https://docs.opensea.io/docs/frequently-asked-questions (Mar 9, 2022)</ref>
<ref name="openseaabout-6985">https://opensea.io/about (Mar 9, 2022)</ref>
<ref name="albinjawi89twitter-7230">[https://twitter.com/Albinjawi89/status/1497843200056504321 @Albinjawi89 Twitter] (Mar 16, 2022)</ref>
<ref name="openseateamarchive-7231">[https://web.archive.org/web/*/openseateam.io Wayback Machine] (Mar 16, 2022)</ref>
<ref name="openseateamarchive-7232">[https://web.archive.org/web/20220227041654/http://openseateam.io/ openseateam.io - contact with domain owner | Epik.com] (Mar 16, 2022)</ref>
<ref name="openseateamarchive-7233">[https://web.archive.org/web/20220311075336/https://openseateam.io/ openseateam.io - contact with domain owner | Epik.com] (Mar 16, 2022)</ref>
<ref name="coinyuppie-7234">[https://web.archive.org/web/20220303141924/https://coinyuppie.com/phishing-attack-from-opensea-to-analyze-blockchain-hacking-methods/ Phishing attack from OpenSea to analyze blockchain hacking methods - CoinYuppie] (Mar 16, 2022)</ref>
<ref name="pcgamer-7692">[https://www.pcgamer.com/opensea-phishing-scam-swindled-millions-in-nfts/ OpenSea phishing scam swindled millions in NFTs - PC Gamer] (May 15, 2022)</ref>
<ref name="openseatwitter-7693">[https://twitter.com/opensea/status/1445121510537109517 OpenSea - "10 tips for avoiding scams and staying safe on the decentralized web" - Twitter] (May 15, 2022)</ref>
</references>