Beeple Twitter Account Hack - Revision history

Azoundria: Another 30 minutes complete. Added technical analysis and expanded the prevention sections. Expanded and revised most text in the article.

2023-12-08T17:57:36Z

Another 30 minutes complete. Added technical analysis and expanded the prevention sections. Expanded and revised most text in the article.

Show changes

Azoundria: Complete another 30 minutes. More sources now merged in. Prevention added.

2023-06-09T19:40:32Z

Complete another 30 minutes. More sources now merged in. Prevention added.

@@ Line 1: / Line 1: @@
-[[File:Beeplemint.jpg|thumb|Beeple Mint scam website.]]Beeple was an extremely successful NFT artist, with works selling for upwards of $69.3m in auctions. On May 22nd, 2022, his Twitter account was compromised and the attackers used their access to launch two separate phishing attacks on his followers, netting them a total of $438k. It does not appear that any of the funds have been recovered.
+{{Case Study Under Construction}}[[File:Beeplemint.jpg|thumb|Beeple Mint scam website.]]Beeple was an extremely successful NFT artist, with works selling for upwards of $69.3m in auctions. On May 22nd, 2022, his Twitter account was compromised and the attackers used their access to launch two separate phishing attacks on his followers, netting them a total of $438k. It does not appear that any of the funds have been recovered.
 == About Beeple ==
 Beeple (also known as Mike Winkelmann<ref name="cointelegraph-8862" />) was a well known artist and NFT creator<ref name="cointelegraph-10443" /> from South Carolina<ref name="onlineonly-10445" /> who has been working on digital art since May 1st, 2007<ref name=":0">[[wikipedia:Mike_Winkelmann|Mike Winkelmann - Wikipedia]] (Feb 15, 2023)</ref>, with his first debut into the NFT space in February 2021<ref name=":0" />. He has created three of the top ten most expensive NFTs sold to date<ref name="cointelegraph-10443" />. One of those, his "first 5,000 days", where he created a new NFT photo for 5,000 days straight<ref name="onlineonly-10445" />, sold for over $69 million<ref name="snikotwitter-10444" /><ref name="onlineonly-10445" /><ref name="cointelegraph-10443" />, the most expensive NFT ever sold to a sole owner<ref name="cointelegraph-10443" />.<blockquote>“I almost look at it now like I’m a political cartoonist,” Beeple explains. “Except instead of doing sketches, I’m using the most advanced 3D tools to make comments on current events, almost in real-time.”</blockquote>Beeple has a strong following of 1.8 million followers and had previously done collaborations with Louis Vuitton, Nike, Katy Perry, and Choldish Gambino<ref name="onlineonly-10445" />. Earlier in May, Beeple had recently started collaborating with Louis Vuitton. Beeple designed 30 NFTs for Louis Vuitton’s "Louis The Game" mobile game, which were embedded within the game as player rewards<ref name="cointelegraph-10443" />.
-On the early morning of May 22nd, 2022, the official account of Beeple posted about an exciting new raffle<ref name="snikotwitter-10444" />.<blockquote>"Been working on this with [Louis Vuitton] for a long time behind the scenes. 1000 total unique pieces.
+On the early morning of May 22nd, 2022, the official account of Beeple posted about an exciting new raffle<ref name="snikotwitter-10444" />. Beeple's profile had also been updated to feature the same link<ref name="snikotwitter-10444" />.<blockquote>"Been working on this with [Louis Vuitton] for a long time behind the scenes. 1000 total unique pieces.
 BEEPLE x VUITTON COLLECTION_!: BEEPLES
@@ Line 65: / Line 65: @@
 |Twitter Report
 |Beeple regains control of their account and posts a tweet<ref name="cointelegraph-10443" /> "Twitter was hacked but we have control now."<ref name="beepletwitter-10456" />
 |}
 == Total Amount Lost ==
@@ Line 72: / Line 98: @@
 There were multiple phishing links posted through the Beeple account. The first netted roughly $73,000<ref name="cointelegraph-10443" /><ref name="etherscan-10449" />. The second netted $365,000 worth of ethereum and several high profile "from high-value collections such as the Mutant Ape Yacht Club, VeeFriends and Otherdeeds", with the grand total being roughly $438,000<ref name="cointelegraph-10443" />.
-Security researcher Harry Denley (@sniko_) reached the same total<ref>[https://twitter.com/sniko_/status/1528383030175444993 Harry Denley (sniko_) Reporting Loss Total - Twitter] (Feb 15, 2023)</ref>.
+Security researcher Harry Denley (@sniko_) reached the same total<ref name=":2">[https://twitter.com/sniko_/status/1528383030175444993 Harry Denley (sniko_) Reporting Loss Total - Twitter] (Feb 15, 2023)</ref>.
 <blockquote>"Scam #1
@@ Line 119: / Line 145: @@
 == Prevention Policies ==
 This can be prevented through exercising care whenever interacting with any smart contract or making any payment. The user must ensure that they understand the transaction prior to sending any funds or approvals.
 == References ==
 <references>

Azoundria: It's ready. Removed templates.

2023-02-15T17:56:44Z

It's ready. Removed templates.

← Older revision		Revision as of 11:56, 15 February 2023
Line 1:		Line 1:
	~~{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/beepletwitteraccounthack.php}}~~
	~~{{Unattributed Citations}}~~

	[[File:Beeplemint.jpg\|thumb\|Beeple Mint scam website.]]Beeple was an extremely successful NFT artist, with works selling for upwards of $69.3m in auctions. On May 22nd, 2022, his Twitter account was compromised and the attackers used their access to launch two separate phishing attacks on his followers, netting them a total of $438k. It does not appear that any of the funds have been recovered.		[[File:Beeplemint.jpg\|thumb\|Beeple Mint scam website.]]Beeple was an extremely successful NFT artist, with works selling for upwards of $69.3m in auctions. On May 22nd, 2022, his Twitter account was compromised and the attackers used their access to launch two separate phishing attacks on his followers, netting them a total of $438k. It does not appear that any of the funds have been recovered.

Azoundria: /* What Happened */

2023-02-15T17:55:14Z

What Happened

← Older revision		Revision as of 11:55, 15 February 2023
Line 30:		Line 30:
	The second attack was described by Harry Denly as being "a little more sophisticated than the first" because it had "a Discord C2". He noted it might be targeting "NFTs with setApprovalForAll()"<ref name="snikotwitter-10448" />.<blockquote>Bad actors continue have access to Beeples Twitter account and they have now tweeted another phishing domain. This one seems a little more sophisticated than the first, having a Discord C2 - still investigating. Potentially targets NFTs with setApprovalForAll().</blockquote>		The second attack was described by Harry Denly as being "a little more sophisticated than the first" because it had "a Discord C2". He noted it might be targeting "NFTs with setApprovalForAll()"<ref name="snikotwitter-10448" />.<blockquote>Bad actors continue have access to Beeples Twitter account and they have now tweeted another phishing domain. This one seems a little more sophisticated than the first, having a Discord C2 - still investigating. Potentially targets NFTs with setApprovalForAll().</blockquote>
	== What Happened ==		== What Happened ==
	Beeple had his Twitter account hacked as part of a phishing scam<ref name="cointelegraph-8862" /> which posted a fake Louis Vuitton NFT raffle<ref name="snikotwitter-10444" /> and a free minting scam. Both links would actually drain funds from user's wallets<ref name="cointelegraph-10443" /><ref name="snikotwitter-10444" />. The phishing links lasted roughly 5 hours<ref name="cointelegraph-10443" /> before Beeple finally woke up<ref name="beepletwitter-10456" /> ~~and removed the links~~.		Beeple had his Twitter account hacked as part of a phishing scam<ref name="cointelegraph-8862" /> which posted a fake Louis Vuitton NFT raffle<ref name="snikotwitter-10444" /> and a free minting scam. Both links would actually drain funds from user's wallets<ref name="cointelegraph-10443" /><ref name="snikotwitter-10444" />. The phishing links lasted roughly 5 hours<ref name="cointelegraph-10443" /> before Beeple finally woke up<ref name="beepletwitter-10456" />.
	{\| class="wikitable"		{\| class="wikitable"
	\|+Key Event Timeline - Beeple Twitter Account Hack		\|+Key Event Timeline - Beeple Twitter Account Hack

Azoundria: /* What Happened */

2023-02-15T17:54:58Z

What Happened

← Older revision		Revision as of 11:54, 15 February 2023
Line 30:		Line 30:
	The second attack was described by Harry Denly as being "a little more sophisticated than the first" because it had "a Discord C2". He noted it might be targeting "NFTs with setApprovalForAll()"<ref name="snikotwitter-10448" />.<blockquote>Bad actors continue have access to Beeples Twitter account and they have now tweeted another phishing domain. This one seems a little more sophisticated than the first, having a Discord C2 - still investigating. Potentially targets NFTs with setApprovalForAll().</blockquote>		The second attack was described by Harry Denly as being "a little more sophisticated than the first" because it had "a Discord C2". He noted it might be targeting "NFTs with setApprovalForAll()"<ref name="snikotwitter-10448" />.<blockquote>Bad actors continue have access to Beeples Twitter account and they have now tweeted another phishing domain. This one seems a little more sophisticated than the first, having a Discord C2 - still investigating. Potentially targets NFTs with setApprovalForAll().</blockquote>
	== What Happened ==		== What Happened ==
	Beeple had his Twitter account hacked as part of a phishing scam<ref name="cointelegraph-8862" /> which posted a fake Louis Vuitton NFT raffle<ref name="snikotwitter-10444" /> and a free minting scam. Both links would actually drain funds from user's wallets<ref name="cointelegraph-10443" /><ref name="snikotwitter-10444" />. The phishing links lasted roughly 5 hours<ref name="cointelegraph-10443" /> before Beeple finally woke up<ref name="beepletwitter-10456" />.		Beeple had his Twitter account hacked as part of a phishing scam<ref name="cointelegraph-8862" /> which posted a fake Louis Vuitton NFT raffle<ref name="snikotwitter-10444" /> and a free minting scam. Both links would actually drain funds from user's wallets<ref name="cointelegraph-10443" /><ref name="snikotwitter-10444" />. The phishing links lasted roughly 5 hours<ref name="cointelegraph-10443" /> before Beeple finally woke up<ref name="beepletwitter-10456" /> and removed the links.
	{\| class="wikitable"		{\| class="wikitable"
	\|+Key Event Timeline - Beeple Twitter Account Hack		\|+Key Event Timeline - Beeple Twitter Account Hack

Azoundria: /* About Beeple */ Adding more on early history. Cleaning up further.

2023-02-15T17:53:47Z

About Beeple: Adding more on early history. Cleaning up further.

← Older revision		Revision as of 11:53, 15 February 2023
Line 5:		Line 5:

	== About Beeple ==		== About Beeple ==
	Beeple (also known as Mike Winkelmann<ref name="cointelegraph-8862" />) was a well known artist and NFT creator<ref name="cointelegraph-10443" /> from South Carolina<ref name="onlineonly-10445" /> who created three of the top ten most expensive NFTs sold to date<ref name="cointelegraph-10443" />. One of those, his "first 5,000 days", where he created a new NFT photo for 5,000 days straight<ref name="onlineonly-10445" />, sold for $69.3 million<ref name="snikotwitter-10444" /><ref name="onlineonly-10445" />, the most expensive NFT ever sold to a sole owner<ref name="cointelegraph-10443" />.<blockquote>“I almost look at it now like I’m a political cartoonist,” Beeple explains. “Except instead of doing sketches, I’m using the most advanced 3D tools to make comments on current events, almost in real-time.”</blockquote>Beeple has a strong following of 1.8 million followers and had previously done collaborations with Louis Vuitton, Nike, Katy Perry, and Choldish Gambino<ref name="onlineonly-10445" />. Earlier in May, Beeple had recently started collaborating with Louis Vuitton. Beeple designed 30 NFTs for Louis Vuitton’s "Louis The Game" mobile game, which were embedded within the game as player rewards<ref name="cointelegraph-10443" />.		Beeple (also known as Mike Winkelmann<ref name="cointelegraph-8862" />) was a well known artist and NFT creator<ref name="cointelegraph-10443" /> from South Carolina<ref name="onlineonly-10445" /> who has been working on digital art since May 1st, 2007<ref name=":0">[[wikipedia:Mike_Winkelmann\|Mike Winkelmann - Wikipedia]] (Feb 15, 2023)</ref>, with his first debut into the NFT space in February 2021<ref name=":0" />. He has created three of the top ten most expensive NFTs sold to date<ref name="cointelegraph-10443" />. One of those, his "first 5,000 days", where he created a new NFT photo for 5,000 days straight<ref name="onlineonly-10445" />, sold for over $69 million<ref name="snikotwitter-10444" /><ref name="onlineonly-10445" /><ref name="cointelegraph-10443" />, the most expensive NFT ever sold to a sole owner<ref name="cointelegraph-10443" />.<blockquote>“I almost look at it now like I’m a political cartoonist,” Beeple explains. “Except instead of doing sketches, I’m using the most advanced 3D tools to make comments on current events, almost in real-time.”</blockquote>Beeple has a strong following of 1.8 million followers and had previously done collaborations with Louis Vuitton, Nike, Katy Perry, and Choldish Gambino<ref name="onlineonly-10445" />. Earlier in May, Beeple had recently started collaborating with Louis Vuitton. Beeple designed 30 NFTs for Louis Vuitton’s "Louis The Game" mobile game, which were embedded within the game as player rewards<ref name="cointelegraph-10443" />.

	On the early morning of May 22nd, 2022, the official account of Beeple posted about an exciting new raffle<ref name="snikotwitter-10444" />.<blockquote>"Been working on this with [Louis Vuitton] for a long time behind the scenes. 1000 total unique pieces.		On the early morning of May 22nd, 2022, the official account of Beeple posted about an exciting new raffle<ref name="snikotwitter-10444" />.<blockquote>"Been working on this with [Louis Vuitton] for a long time behind the scenes. 1000 total unique pieces.
Line 21:		Line 21:

	Good luck :)"</blockquote>		Good luck :)"</blockquote>


	* Known history of when and how the service was started.
	* What problems does the company or service claim to solve?
	* What marketing materials were used by the firm or business?
	* Audits performed, and excerpts that may have been included.
	* Business registration documents shown (fake or legitimate).
	* How were people recruited to participate?
	* Public warnings and announcements prior to the event.

	~~Don't Include:~~
	* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
	* Anything that wasn't reasonably knowable at the time of the event.
	~~There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.~~

	== The Reality ==		== The Reality ==
	Beeple's account had been hacked<ref name="cointelegraph-10443" /> and the raffle was not real. As explained by Harry Denley (@sniko_), the website was malicious and users who participated in attacks simply forfeited their ETH<ref name="snikotwitter-10444" /><ref name="etherscan-10449" />. The registered IP addresses used in the attacks had previously been involved is numerous malicious websites and scam operations<ref name="dubstardtwitter-10446" /><ref name="snikotwitter-10444" />.		Beeple's Twitter account had been hacked<ref name="cointelegraph-10443" /> and the raffle was not real. As explained by Harry Denley (@sniko_), the website was malicious and users who participated in attacks simply forfeited their ETH<ref name="snikotwitter-10444" /><ref name="etherscan-10449" />. The registered IP addresses used in the attacks had previously been involved is numerous malicious websites and scam operations<ref name="dubstardtwitter-10446" /><ref name="snikotwitter-10444" />. Harry Denley described the first attack<ref name="snikotwitter-10444" />.

	<blockquote>"Once you've connected your wallet, will initiate a mint() contract call ~~to 0x7b69c4f2ACF77300025E49DbDbB65B068b2Fda7D,~~ which will send 1ETH to the contract." "As of typing the website is not weaponised to "drain" wallets by filling the wallet tx queue (like we've seen before)"		<blockquote>"Once you've connected your wallet, will initiate a mint() contract call which will send 1ETH to the contract." "As of typing the website is not weaponised to "drain" wallets by filling the wallet tx queue (like we've seen before)"

	"The contract you are sending a transaction to is in fact a 721 contract, with mint() function defined as: The owner of the contract can withdraw the funds at any moment"</blockquote>		"The contract you are sending a transaction to is in fact a 721 contract, with mint() function defined as: The owner of the contract can withdraw the funds at any moment"</blockquote>

			The second attack was described by Harry Denly as being "a little more sophisticated than the first" because it had "a Discord C2". He noted it might be targeting "NFTs with setApprovalForAll()"<ref name="snikotwitter-10448" />.<blockquote>Bad actors continue have access to Beeples Twitter account and they have now tweeted another phishing domain. This one seems a little more sophisticated than the first, having a Discord C2 - still investigating. Potentially targets NFTs with setApprovalForAll().</blockquote>
	== What Happened ==		== What Happened ==
	Beeple had his Twitter account hacked as part of a phishing scam<ref name="cointelegraph-8862" /> which posted a fake Louis Vuitton NFT raffle<ref name="snikotwitter-10444" /> and a free minting scam. Both links would actually drain funds from user's wallets<ref name="cointelegraph-10443" /><ref name="snikotwitter-10444" />. The phishing links lasted roughly 5 hours<ref name="cointelegraph-10443" /> before ~~beeple~~ finally woke up<ref name="beepletwitter-10456" />.		Beeple had his Twitter account hacked as part of a phishing scam<ref name="cointelegraph-8862" /> which posted a fake Louis Vuitton NFT raffle<ref name="snikotwitter-10444" /> and a free minting scam. Both links would actually drain funds from user's wallets<ref name="cointelegraph-10443" /><ref name="snikotwitter-10444" />. The phishing links lasted roughly 5 hours<ref name="cointelegraph-10443" /> before Beeple finally woke up<ref name="beepletwitter-10456" />.
	{\| class="wikitable"		{\| class="wikitable"
	\|+Key Event Timeline - Beeple Twitter Account Hack		\|+Key Event Timeline - Beeple Twitter Account Hack
Line 54:		Line 39:
	\|March 11th, 2022 8:02:00 AM		\|March 11th, 2022 8:02:00 AM
	\|Record NFT Sale		\|Record NFT Sale
	\|The auction price of Beeple's NFT "EVERYDAYS: THE FIRST 5000 DAYS" exceeds $60m<ref name="snikotwitter-10447" />.		\|The auction price of Beeple's NFT "EVERYDAYS: THE FIRST 5000 DAYS" exceeds $60m<ref name="snikotwitter-10447" />. Source are mixed between a price tag of $69m<ref name="snikotwitter-10447" />, $69.3m<ref name="cointelegraph-10443" />, and $69.4m<ref name=":0" />.
	\|-		\|-
	\|May 22nd, 2022 3:20:00 AM		\|May 22nd, 2022 3:20:00 AM
Line 62:		Line 47:
	\|May 22nd, 2022 4:24:00 AM		\|May 22nd, 2022 4:24:00 AM
	\|Twitter Report		\|Twitter Report
	\|The first ~~hack~~ is reported on Twitter by Harry Denley (@_sniko)<ref name="cointelegraph-10443" /><ref name="snikotwitter-10444" />. At the time of that tweet, losses were reported as 25 ETH/$50k<ref name="snikotwitter-10444" />.		\|The first phishing attack is reported on Twitter by Harry Denley (@_sniko)<ref name="cointelegraph-10443" /><ref name="snikotwitter-10444" />. At the time of that tweet, losses were reported as 25 ETH/$50k<ref name="snikotwitter-10444" />.
	\|-		\|-
	\|May 22nd, 2022 5:21:00 AM		\|May 22nd, 2022 5:21:00 AM
Line 90:		Line 75:
	There were multiple phishing links posted through the Beeple account. The first netted roughly $73,000<ref name="cointelegraph-10443" /><ref name="etherscan-10449" />. The second netted $365,000 worth of ethereum and several high profile "from high-value collections such as the Mutant Ape Yacht Club, VeeFriends and Otherdeeds", with the grand total being roughly $438,000<ref name="cointelegraph-10443" />.		There were multiple phishing links posted through the Beeple account. The first netted roughly $73,000<ref name="cointelegraph-10443" /><ref name="etherscan-10449" />. The second netted $365,000 worth of ethereum and several high profile "from high-value collections such as the Mutant Ape Yacht Club, VeeFriends and Otherdeeds", with the grand total being roughly $438,000<ref name="cointelegraph-10443" />.

	Security researcher Harry Denley (@sniko_) reached the same total ~~via a slightly different calculation~~.		Security researcher Harry Denley (@sniko_) reached the same total<ref>[https://twitter.com/sniko_/status/1528383030175444993 Harry Denley (sniko_) Reporting Loss Total - Twitter] (Feb 15, 2023)</ref>.

	<blockquote>"Scam #1		<blockquote>"Scam #1
Line 108:		Line 93:
	Multiple posts were shared by MetaMask Security Analyst Harry Denley (@sniko_) on Twitter to warn other users<ref name="cointelegraph-10443" /><ref name="snikotwitter-10444" />.		Multiple posts were shared by MetaMask Security Analyst Harry Denley (@sniko_) on Twitter to warn other users<ref name="cointelegraph-10443" /><ref name="snikotwitter-10444" />.

	<blockquote>Beeple's Twitter account has been compromised (ATO) to post a phishing website to steal funds.</blockquote>The second attack was described by Harry Denly as being "a little more sophisticated than the first" because it had "a Discord C2". He noted it might be targeting "NFTs with setApprovalForAll()"<ref name="snikotwitter-10448" />.<blockquote>Bad actors continue have access to Beeples Twitter account and they have now tweeted another phishing domain. This one seems a little more sophisticated than the first, having a Discord C2 - still investigating. Potentially targets NFTs with setApprovalForAll().</blockquote>		<blockquote>Beeple's Twitter account has been compromised (ATO) to post a phishing website to steal funds.</blockquote>Examples of victims were Twitter users @Helisegundo<ref name="hellsegundotwitter-10457" /> and @nfactes<ref name="nfactestwitter-10458" />.

	Examples of victims were Twitter users @Helisegundo<ref name="hellsegundotwitter-10457" /> and @nfactes<ref name="nfactestwitter-10458" />:

	<blockquote>"Dumbly I have clicked on the link and connected my wallet and been scammed. Damn I've check again and they also stole 2 of my nfts"</blockquote>		<blockquote>"Dumbly I have clicked on the link and connected my wallet and been scammed. Damn I've check again and they also stole 2 of my nfts"</blockquote>
Line 123:		Line 106:
	Twitter was hacked but we have control now. Huge thanks to @garyvee ‘a team for quick help!!!!		Twitter was hacked but we have control now. Huge thanks to @garyvee ‘a team for quick help!!!!

	Stay safe out there, anything too good to be true IS A ~~FUCKING~~ SCAM.		Stay safe out there, anything too good to be true IS A [DEFINITE] SCAM.

	And as side note, there will never be a SURPRISE MINT I mention one time in one place starting at 6am Sunday morning.</blockquote>On-chain data shows that the scammer sold their NFTs on OpenSea and put the stolen ethereum into a cryptocurrency mixing service<ref name="cointelegraph-10443" />.		And as side note, there will never be a SURPRISE MINT I mention one time in one place starting at 6am Sunday morning.</blockquote>On-chain data shows that the scammer sold their NFTs on OpenSea and put the stolen ethereum into a cryptocurrency mixing service<ref name="cointelegraph-10443" />.
Line 130:		Line 113:
	It does not appear that any recovery has been obtained for any users affected. Quoting @super1said<ref name="super1saidtwitter-10459" />:		It does not appear that any recovery has been obtained for any users affected. Quoting @super1said<ref name="super1saidtwitter-10459" />:

	<blockquote>"They ~~dont Care~~ bro. We are nobody ~~the Guy~~ had more then 156 ~~nfts~~ stolen and ~~alreadly~~ sold more then 80 of them my trust in ~~this shit nfts~~ is getting smaller by the day"</blockquote>		<blockquote>"They don[']t [c]are bro. We are nobody[. T]he [g]uy had more then 156 [NFT]s stolen and [already] sold more then 80 of them[. M]y trust in [NFTs] is getting smaller by the day."</blockquote>

	There do not appear to have been any funds recovered in this case.		There do not appear to have been any funds recovered in this case.

	== Ongoing Developments ==		== Ongoing Developments ==
	There ~~don~~'t appear to be any ongoing ~~events remaining~~.		There doesn't appear to be any ongoing investigation or further progress in this case.

	== Prevention Policies ==		== Prevention Policies ==

Azoundria: /* About Beeple */

2023-02-15T17:25:37Z

About Beeple

← Older revision		Revision as of 11:25, 15 February 2023
Line 5:		Line 5:

	== About Beeple ==		== About Beeple ==
	Beeple (also known as Mike Winkelmann<ref name="cointelegraph-8862" />) was a well known artist and NFT creator<ref name="cointelegraph-10443" /> from South Carolina<ref name="onlineonly-10445" /> who created three of the top ten most expensive NFTs sold to date<ref name="cointelegraph-10443" />. One of those, his "first 5,000 days", where he created a new NFT photo for 5,000 days straight<ref name="onlineonly-10445" />, sold for $69.3 million<ref name="snikotwitter-10444" /><ref name="onlineonly-10445" />, the most expensive NFT ever sold to a sole owner<ref name="cointelegraph-10443" />.<blockquote>“I almost look at it now like I’m a political cartoonist,” Beeple explains. “Except instead of doing sketches, I’m using the most advanced 3D tools to make comments on current events, almost in real-time.”</blockquote>Beeple has a strong following of 1.8 million followers and had previously done collaborations with Louis Vuitton, Nike, Katy Perry, and Choldish Gambino<ref name="onlineonly-10445" />. Beeple had recently started collaborating with Louis Vuitton ~~on an NFT project~~. ~~Earlier in May, NFT creator~~ Beeple designed 30 NFTs for Louis Vuitton’s "Louis The Game" mobile game, which were embedded within the game as player rewards<ref name="cointelegraph-10443" />.		Beeple (also known as Mike Winkelmann<ref name="cointelegraph-8862" />) was a well known artist and NFT creator<ref name="cointelegraph-10443" /> from South Carolina<ref name="onlineonly-10445" /> who created three of the top ten most expensive NFTs sold to date<ref name="cointelegraph-10443" />. One of those, his "first 5,000 days", where he created a new NFT photo for 5,000 days straight<ref name="onlineonly-10445" />, sold for $69.3 million<ref name="snikotwitter-10444" /><ref name="onlineonly-10445" />, the most expensive NFT ever sold to a sole owner<ref name="cointelegraph-10443" />.<blockquote>“I almost look at it now like I’m a political cartoonist,” Beeple explains. “Except instead of doing sketches, I’m using the most advanced 3D tools to make comments on current events, almost in real-time.”</blockquote>Beeple has a strong following of 1.8 million followers and had previously done collaborations with Louis Vuitton, Nike, Katy Perry, and Choldish Gambino<ref name="onlineonly-10445" />. Earlier in May, Beeple had recently started collaborating with Louis Vuitton. Beeple designed 30 NFTs for Louis Vuitton’s "Louis The Game" mobile game, which were embedded within the game as player rewards<ref name="cointelegraph-10443" />.

	On the early morning of May 22nd, 2022, the official account of Beeple posted about an exciting new raffle<ref name="snikotwitter-10444" />.<blockquote>"Been working on this with [Louis Vuitton] for a long time behind the scenes. 1000 total unique pieces.		On the early morning of May 22nd, 2022, the official account of Beeple posted about an exciting new raffle<ref name="snikotwitter-10444" />.<blockquote>"Been working on this with [Louis Vuitton] for a long time behind the scenes. 1000 total unique pieces.

Azoundria: /* Immediate Reactions */ super1said - "They dont Care bro. We are nobody" - Twitter (Feb 4, 2023)

2023-02-14T20:58:24Z

Immediate Reactions: super1said - "They dont Care bro. We are nobody" - Twitter (Feb 4, 2023)

← Older revision		Revision as of 14:58, 14 February 2023
Line 3:		Line 3:

	[[File:Beeplemint.jpg\|thumb\|Beeple Mint scam website.]]Beeple was an extremely successful NFT artist, with works selling for upwards of $69.3m in auctions. On May 22nd, 2022, his Twitter account was compromised and the attackers used their access to launch two separate phishing attacks on his followers, netting them a total of $438k. It does not appear that any of the funds have been recovered.		[[File:Beeplemint.jpg\|thumb\|Beeple Mint scam website.]]Beeple was an extremely successful NFT artist, with works selling for upwards of $69.3m in auctions. On May 22nd, 2022, his Twitter account was compromised and the attackers used their access to launch two separate phishing attacks on his followers, netting them a total of $438k. It does not appear that any of the funds have been recovered.

	~~This is a global/international case not involving a specific country.<ref name="hellsegundotwitter-10457" /><ref name="nfactestwitter-10458" /><ref name="super1saidtwitter-10459" />~~

	== About Beeple ==		== About Beeple ==
Line 112:		Line 110:
	<blockquote>Beeple's Twitter account has been compromised (ATO) to post a phishing website to steal funds.</blockquote>The second attack was described by Harry Denly as being "a little more sophisticated than the first" because it had "a Discord C2". He noted it might be targeting "NFTs with setApprovalForAll()"<ref name="snikotwitter-10448" />.<blockquote>Bad actors continue have access to Beeples Twitter account and they have now tweeted another phishing domain. This one seems a little more sophisticated than the first, having a Discord C2 - still investigating. Potentially targets NFTs with setApprovalForAll().</blockquote>		<blockquote>Beeple's Twitter account has been compromised (ATO) to post a phishing website to steal funds.</blockquote>The second attack was described by Harry Denly as being "a little more sophisticated than the first" because it had "a Discord C2". He noted it might be targeting "NFTs with setApprovalForAll()"<ref name="snikotwitter-10448" />.<blockquote>Bad actors continue have access to Beeples Twitter account and they have now tweeted another phishing domain. This one seems a little more sophisticated than the first, having a Discord C2 - still investigating. Potentially targets NFTs with setApprovalForAll().</blockquote>

	Examples of victims were Twitter users @Helisegundo and @nfactes:		Examples of victims were Twitter users @Helisegundo<ref name="hellsegundotwitter-10457" /> and @nfactes<ref name="nfactestwitter-10458" />:

	<blockquote>"Dumbly I have clicked on the link and connected my wallet and been scammed. Damn I've check again and they also stole 2 of my nfts"</blockquote>		<blockquote>"Dumbly I have clicked on the link and connected my wallet and been scammed. Damn I've check again and they also stole 2 of my nfts"</blockquote>
Line 130:		Line 128:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	It does not appear that any recovery has been obtained for any users affected. Quoting @super1said:		It does not appear that any recovery has been obtained for any users affected. Quoting @super1said<ref name="super1saidtwitter-10459" />:

	<blockquote>"They dont Care bro. We are nobody the Guy had more then 156 nfts stolen and alreadly sold more then 80 of them my trust in this shit nfts is getting smaller by the day"</blockquote>		<blockquote>"They dont Care bro. We are nobody the Guy had more then 156 nfts stolen and alreadly sold more then 80 of them my trust in this shit nfts is getting smaller by the day"</blockquote>
Line 158:		Line 156:
	<ref name="etherscan-10455">[https://etherscan.io/tx/0xc00473abd9f66a79519c7393cd0e384d0475daede5103c77685ee7f095015000 Ethereum Transaction Hash - First Transfer From Second Phish - Etherscan] (Feb 4, 2023)</ref>		<ref name="etherscan-10455">[https://etherscan.io/tx/0xc00473abd9f66a79519c7393cd0e384d0475daede5103c77685ee7f095015000 Ethereum Transaction Hash - First Transfer From Second Phish - Etherscan] (Feb 4, 2023)</ref>
	<ref name="beepletwitter-10456">[https://twitter.com/beeple/status/1528380635081068544 beeple - "ugh we’ll that was fun way to wake up" - Twitter] (Feb 4, 2023)</ref>		<ref name="beepletwitter-10456">[https://twitter.com/beeple/status/1528380635081068544 beeple - "ugh we’ll that was fun way to wake up" - Twitter] (Feb 4, 2023)</ref>
	<ref name="hellsegundotwitter-10457">[https://twitter.com/Hellsegundo/status/1528396665312649216 @Hellsegundo Twitter] (Feb 4, 2023)</ref>		<ref name="hellsegundotwitter-10457">[https://twitter.com/Hellsegundo/status/1528396665312649216 Hellsegundo - "Dumbly I have clicked on the link and connected my wallet and been scammed" - Twitter] (Feb 4, 2023)</ref>
	<ref name="nfactestwitter-10458">[https://twitter.com/nfactes/status/1528381359294754823 @nfactes Twitter] (Feb 4, 2023)</ref>		<ref name="nfactestwitter-10458">[https://twitter.com/nfactes/status/1528381359294754823 nfactes - "lost 1 eth believing it was a real account" - Twitter] (Feb 4, 2023)</ref>
	<ref name="super1saidtwitter-10459">[https://twitter.com/super1said/status/1528384852147458050 @super1said Twitter] (Feb 4, 2023)</ref>		<ref name="super1saidtwitter-10459">[https://twitter.com/super1said/status/1528384852147458050 super1said - "They dont Care bro. We are nobody" - Twitter] (Feb 4, 2023)</ref>
	</references>		</references>

Azoundria at 20:54, 14 February 2023

2023-02-14T20:54:47Z

← Older revision		Revision as of 14:54, 14 February 2023
Line 153:		Line 153:
	<ref name="etherscan-10449">[https://etherscan.io/address/0x7b69c4f2ACF77300025E49DbDbB65B068b2Fda7D First Smart Contract "Fake_Phishing5739" - Etherscan] (Feb 4, 2023)</ref>		<ref name="etherscan-10449">[https://etherscan.io/address/0x7b69c4f2ACF77300025E49DbDbB65B068b2Fda7D First Smart Contract "Fake_Phishing5739" - Etherscan] (Feb 4, 2023)</ref>
	<ref name="etherscan-10450">[https://etherscan.io/tx/0x0a37968cec5693dd940b3080583e5cd08869349ea9c6b0ee671a114bc27fc077 Ethereum Transaction Hash - First Phishing Mint legalguy.eth - Etherscan] (Feb 4, 2023)</ref>		<ref name="etherscan-10450">[https://etherscan.io/tx/0x0a37968cec5693dd940b3080583e5cd08869349ea9c6b0ee671a114bc27fc077 Ethereum Transaction Hash - First Phishing Mint legalguy.eth - Etherscan] (Feb 4, 2023)</ref>
	~~<ref name="etherscan-10451">[https://etherscan.io/txs?a=0x7b69c4f2ACF77300025E49DbDbB65B068b2Fda7D Ethereum Transactions Information \| Etherscan] (Feb 4)</ref>~~
	<ref name="etherscan-10452">[https://etherscan.io/tx/0x601f3f609e05390d7fad544d5f9e848fbcb6658ee2390435a0a01e24de196261 Ethereum Transaction Hash - Final Approval From First Phish - Etherscan] (Feb 4, 2023)</ref>		<ref name="etherscan-10452">[https://etherscan.io/tx/0x601f3f609e05390d7fad544d5f9e848fbcb6658ee2390435a0a01e24de196261 Ethereum Transaction Hash - Final Approval From First Phish - Etherscan] (Feb 4, 2023)</ref>
	<ref name="etherscan-10453">[https://etherscan.io/address/0xcad7fc974F61A08ADEF110D1BA446fa5b5B5Bb27 Second Exploit Address "Fake_Phishing5741" - Etherscan] (Feb 4, 2023)</ref>		<ref name="etherscan-10453">[https://etherscan.io/address/0xcad7fc974F61A08ADEF110D1BA446fa5b5B5Bb27 Second Exploit Address "Fake_Phishing5741" - Etherscan] (Feb 4, 2023)</ref>

Azoundria: beeple - "ugh we’ll that was fun way to wake up" - Twitter (Feb 4, 2023)

2023-02-14T20:54:13Z

beeple - "ugh we’ll that was fun way to wake up" - Twitter (Feb 4, 2023)

← Older revision		Revision as of 14:54, 14 February 2023
Line 4:		Line 4:
	[[File:Beeplemint.jpg\|thumb\|Beeple Mint scam website.]]Beeple was an extremely successful NFT artist, with works selling for upwards of $69.3m in auctions. On May 22nd, 2022, his Twitter account was compromised and the attackers used their access to launch two separate phishing attacks on his followers, netting them a total of $438k. It does not appear that any of the funds have been recovered.		[[File:Beeplemint.jpg\|thumb\|Beeple Mint scam website.]]Beeple was an extremely successful NFT artist, with works selling for upwards of $69.3m in auctions. On May 22nd, 2022, his Twitter account was compromised and the attackers used their access to launch two separate phishing attacks on his followers, netting them a total of $438k. It does not appear that any of the funds have been recovered.

	This is a global/international case not involving a specific country.~~<ref name="beepletwitter-10456" />~~<ref name="hellsegundotwitter-10457" /><ref name="nfactestwitter-10458" /><ref name="super1saidtwitter-10459" />		This is a global/international case not involving a specific country.<ref name="hellsegundotwitter-10457" /><ref name="nfactestwitter-10458" /><ref name="super1saidtwitter-10459" />

	== About Beeple ==		== About Beeple ==
Line 47:		Line 47:

	== What Happened ==		== What Happened ==
	Beeple had his Twitter account hacked as part of a phishing scam<ref name="cointelegraph-8862" /> which posted a fake Louis Vuitton NFT raffle<ref name="snikotwitter-10444" /> and a free minting scam. Both links would actually drain funds from user's wallets<ref name="cointelegraph-10443" /><ref name="snikotwitter-10444" />. The phishing links lasted roughly 5 hours<ref name="cointelegraph-10443" />.		Beeple had his Twitter account hacked as part of a phishing scam<ref name="cointelegraph-8862" /> which posted a fake Louis Vuitton NFT raffle<ref name="snikotwitter-10444" /> and a free minting scam. Both links would actually drain funds from user's wallets<ref name="cointelegraph-10443" /><ref name="snikotwitter-10444" />. The phishing links lasted roughly 5 hours<ref name="cointelegraph-10443" /> before beeple finally woke up<ref name="beepletwitter-10456" />.
	{\| class="wikitable"		{\| class="wikitable"
	\|+Key Event Timeline - Beeple Twitter Account Hack		\|+Key Event Timeline - Beeple Twitter Account Hack
Line 84:		Line 84:
	\|May 22nd, 2022 8:21:00 AM		\|May 22nd, 2022 8:21:00 AM
	\|Twitter Report		\|Twitter Report
	\|Beeple regains control of their account and posts a tweet<ref name="cointelegraph-10443" /> "Twitter was hacked but we have control now."		\|Beeple regains control of their account and posts a tweet<ref name="cointelegraph-10443" /> "Twitter was hacked but we have control now."<ref name="beepletwitter-10456" />
	\|}		\|}

Line 119:		Line 119:

	== Ultimate Outcome ==		== Ultimate Outcome ==
	Beeple regained control of his account and posted to announce the fraud, calling it "too good to be true" that there would be a free mint and criticizing those who fell for it<ref name="cointelegraph-10443" />.		Beeple regained control of his account and posted to announce the fraud<ref name="beepletwitter-10456" />, calling it "too good to be true" that there would be a free mint and criticizing those who fell for it<ref name="cointelegraph-10443" /><ref name="beepletwitter-10456" />.

	<blockquote>ugh we’ll that was fun way to wake up.		<blockquote>ugh we’ll that was fun way to wake up.
Line 158:		Line 158:
	<ref name="etherscan-10454">[https://etherscan.io/tx/0x16dab8d5f56f1923469d95c823c8c620fe8887b88b2c570479ae6b689830a49e Ethereum Transaction Hash - Final Phishing Transaction - Etherscan] (Feb 4, 2023)</ref>		<ref name="etherscan-10454">[https://etherscan.io/tx/0x16dab8d5f56f1923469d95c823c8c620fe8887b88b2c570479ae6b689830a49e Ethereum Transaction Hash - Final Phishing Transaction - Etherscan] (Feb 4, 2023)</ref>
	<ref name="etherscan-10455">[https://etherscan.io/tx/0xc00473abd9f66a79519c7393cd0e384d0475daede5103c77685ee7f095015000 Ethereum Transaction Hash - First Transfer From Second Phish - Etherscan] (Feb 4, 2023)</ref>		<ref name="etherscan-10455">[https://etherscan.io/tx/0xc00473abd9f66a79519c7393cd0e384d0475daede5103c77685ee7f095015000 Ethereum Transaction Hash - First Transfer From Second Phish - Etherscan] (Feb 4, 2023)</ref>
	<ref name="beepletwitter-10456">[https://twitter.com/beeple/status/1528380635081068544 @beeple Twitter] (Feb 4, 2023)</ref>		<ref name="beepletwitter-10456">[https://twitter.com/beeple/status/1528380635081068544 beeple - "ugh we’ll that was fun way to wake up" - Twitter] (Feb 4, 2023)</ref>
	<ref name="hellsegundotwitter-10457">[https://twitter.com/Hellsegundo/status/1528396665312649216 @Hellsegundo Twitter] (Feb 4, 2023)</ref>		<ref name="hellsegundotwitter-10457">[https://twitter.com/Hellsegundo/status/1528396665312649216 @Hellsegundo Twitter] (Feb 4, 2023)</ref>
	<ref name="nfactestwitter-10458">[https://twitter.com/nfactes/status/1528381359294754823 @nfactes Twitter] (Feb 4, 2023)</ref>		<ref name="nfactestwitter-10458">[https://twitter.com/nfactes/status/1528381359294754823 @nfactes Twitter] (Feb 4, 2023)</ref>
	<ref name="super1saidtwitter-10459">[https://twitter.com/super1said/status/1528384852147458050 @super1said Twitter] (Feb 4, 2023)</ref>		<ref name="super1saidtwitter-10459">[https://twitter.com/super1said/status/1528384852147458050 @super1said Twitter] (Feb 4, 2023)</ref>
	</references>		</references>