Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/metamaskwalletnfttheftbaconm77michaelbode.php}} {{Unattributed Sources}} Michael Bode NFT TransfersNFT enthusiast and collector Michael Bode saw all of his NFTs lost after his wallet was drained, which he attributes to a MetaMask breach. One of the NFTs was purchased by another user MrRayG for 0.9 ETH, and MrRayG returned the NFT for free after it was flagged on..."

2023-12-05T18:55:08Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/metamaskwalletnfttheftbaconm77michaelbode.php}} {{Unattributed Sources}} thumb|Michael Bode NFT TransfersNFT enthusiast and collector Michael Bode saw all of his NFTs lost after his wallet was drained, which he attributes to a MetaMask breach. One of the NFTs was purchased by another user MrRayG for 0.9 ETH, and MrRayG returned the NFT for free after it was flagged on..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/metamaskwalletnfttheftbaconm77michaelbode.php}}
{{Unattributed Sources}}

[[File:Michaelbodenfts.jpg|thumb|Michael Bode NFT Transfers]]NFT enthusiast and collector Michael Bode saw all of his NFTs lost after his wallet was drained, which he attributes to a MetaMask breach. One of the NFTs was purchased by another user MrRayG for 0.9 ETH, and MrRayG returned the NFT for free after it was flagged on the OpenSea platform. Some NFTs remained in the wallet and were transferred to a new ethereum address. It is still being investigated what happened to the other NFTs.

This is a global/international case not involving a specific country.<ref name="mrraygtwitter-12613" /><ref name="mrraygtwitter-12614" /><ref name="etherscan-12615" /><ref name="opensea-12616" /><ref name="etherscan-12617" /><ref name="etherscan-12618" /><ref name="mrraygtwitter-12619" /><ref name="mrraygtwitter-12620" /><ref name="mrraygtwitter-12621" /><ref name="empstudio4twitter-12622" /><ref name="mrraygtwitter-12623" /><ref name="mrraygtwitter-12624" /><ref name="mrraygtwitter-12625" /><ref name="mrraygtwitter-12626" /><ref name="baconm77twitter-12627" /><ref name="etherscan-12628" /><ref name="etherscan-12629" /><ref name="etherscan-12630" /><ref name="etherscan-12631" /><ref name="etherscan-12632" /><ref name="etherscan-12633" /><ref name="nft-12634" /><ref name="etherscan-12635" /><ref name="nft-12636" /><ref name="baconm77twitter-12637" /><ref name="mrraygtwitter-12638" /><ref name="mrraygtwitter-12639" /><ref name="baconm77twitter-12640" /><ref name="mrraygtwitter-12641" /><ref name="mrraygtwitter-12642" />

== About None ==
"Can anyone please help?!?!?! My MM account was hacked. I lost everything!!!!"

"Can you connect with me on DM? I bought your Lazy Lion and didn’t know your account was hacked or compromised. Happy to sell it back to you as i see you flagged it with @opensea and now it doesn’t allow me to sell it."

"It happened to me. I bought a stolen NFT shortly after it was transferred, listed and then sold to me with NO knowledge it was stolen. ETH spent and a day later it was flagged by @opensea. Solution: found the original owner and gave it back! Be safe out there."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - MetaMask Wallet NFT Theft Baconm77/Michael Bode
!Date
!Event
!Description
|-
|May 17th, 2022 7:49:37 AM MDT
|Vee Friends 21966
|Vee Friends 21966 is the first NFT transferred from the MetaMask account of Baconm77 is transferred to an unknown address.
|-
|May 17th, 2022 7:51:14 AM MDT
|HAPE 1804 transferred
|HAPE 1804 is transferred from the MetaMask account of Baconm77 is transferred to an unknown address.
|-
|May 17th, 2022 8:07:15 AM MDT
|Lazy Lion 1640 transferred
|The stolen Lazy Lion 1640 from the MetaMask account of Baconm77 is transferred to an unknown address.
|-
|May 17th, 2022 8:09:23 AM MDT
|Bunny Buddy 980 Transferred
|Bunny Buddy 980 is the last NFT transferred from Baconm77 to an unknown address.
|-
|May 17th, 2022 10:28:00 AM MDT
|Baconm77 OpenSea Theft Post
|Baconm77 reports that their MetaMask account was hacked and provides a photograph of their computer with a list of NFTs which were taken.
|-
|May 18th, 2022 12:21:00 PM MDT
|Response To Victim
|MrRayG responds to Twitter user Baconm77, who reports that their MetaMask account was hacked. "Can you connect with me on DM? I bought your Lazy Lion and didn’t know your account was hacked or compromised. Happy to sell it back to you as i see you flagged it with @opensea and now it doesn’t allow me to sell it." In MrRayG's tweet, it is again mentioned here that the NFT has been "flagged by @opensea" "a day later" "after it was transferred".
|-
|May 21st, 2022 10:36:00 AM MDT
|Acknowledgement
|Baconm77 tweets that he "want[s] to ta[ke a] second to recognize [MrRayG]". "This man spent his own money to buy it not knowing it was from a hacker. He just sent it back to me. Please go follow and acknowledge this man. Thank you[.]" He references MrZombieApoc, which appears to be a former handle of MrRayG.
|-
|May 22nd, 2022 11:01:49 AM MDT
|NFT To MrRayG
|MrRayG purchases LazyLion 4147, which is pictured in the post about the stolen NFT, appears to come into the possession of MrRayG.
|-
|May 23rd, 2022 9:44:37 AM MDT
|New Wallet Transfer
|Baconm77 appears to have set up a new wallet (michaelbode.eth) and starts to transfer the remaining NFTs there.
|-
|May 26th, 2022 7:09:00 PM MDT
|Safety Recommendation
|MrRayG recommends users to "[c]heck activity to avoid purchasing a stolen NFT" in response to another user.
|-
|May 26th, 2022 8:58:00 PM MDT
|Reply To Seth Green
|MrRayG reports that he "bought a stolen NFT shortly after it was transferred" "with NO knowledge it was stolen". He also states that he "found the original owner and gave it back" and is "back with this beauty", referencing Lazy Lion 4147, which he recently purchased.
|-
|May 26th, 2022 9:27:00 PM MDT
|Question About Return
|Twitter user EMPStudio4 questions MrRayG as to whether he "g[o]t the eth [he] used to purchase [the NFT] refunded back to" him when he gave "it back to the original owner". This question is unanswered.
|-
|May 27th, 2022 8:14:00 AM MDT
|Reply To OpenSea
|"Do you really care about Web3 with your “GM”? I beg to differ. Protect your users! Build better! Build safer!"
|-
|May 28th, 2022 11:08:00 AM MDT
|Crazy Space Out There
|MrRayG tweets to "[b]e careful out there creators, collectors, and traders. Its a crazy space but we are building better! #AAPES is here to stay. Transparency is the only way."
|-
|May 31st, 2022 10:46:00 AM MDT
|Exciting Accountability
|"What excites [MrRayG] the most [about Web3] is for pioneers like @opensea to be accountable in building a safer and more welcoming future for new users."
|-
|June 10th, 2022 10:33:00 AM MDT
|Praise To LooksRare
|MrRayG praises LooksRare "for adding the warning of an NFT being untradable on @opensea" and "being part of the solution".
|-
|July 25th, 2022 6:56:00 AM MDT
|Shared Experiences
|MrRayG responds to user B0x182 about a compromised NFT, to share his experiences. He suggests that their "stolen NFT process and policy needs to be revisited".
|-
|August 7th, 2022 10:00:00 AM MDT
|OpenSea Criticism
|MrRayG posts another criticism of OpenSea for their poor handling of thefts.
|-
|August 11th, 2022 7:41:00 AM MDT
|OpenSea Support
|MrRayG praises OpenSea for posting a new policy on handling of thefts in the platform, calling it "a great post to address the [elephant] in the room" and that enabling sales of potentially stolen NFTs if a police report isn't received within 7 days is "a GREAT first step".
|-
|October 17th, 2022 5:00:00 PM MDT
|Debate About Ownership
|"I rather imagine that the solution to NFTs getting stolen is near!"
|-
|January 14th, 2023 10:19:47 PM MST
|NFT Resold
|According to the blockchain record, the NFT is resold to the user 0_oRare.
|-
|January 20th, 2023 6:08:00 AM MST
|OpenSea Did Nothing
|Another user franklinisbored reports that a stolen ape was sold to their current active bid offer. MrRayG responds that it also "[h]appened to [him] and @opensea did nothing."
|}

== Technical Details ==
This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
At least Lazy Lion 1640.

The total amount recovered is unknown.

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="mrraygtwitter-12613">[https://twitter.com/MrRayG/status/1530020558922043392 @MrRayG Twitter] (Feb 5, 2023)</ref>

<ref name="mrraygtwitter-12614">[https://twitter.com/MrRayG/status/1528435831563771904 @MrRayG Twitter] (Dec 4, 2023)</ref>

<ref name="etherscan-12615">[https://etherscan.io/tx/0xbcedcd35875f6bb0ea74e994d2143382fabbea5e75a3f7ab575b25f6b1277dd7 Ethereum Transaction Hash (Txhash) Details | Etherscan] (Dec 4, 2023)</ref>

<ref name="opensea-12616">[https://opensea.io/assets/ethereum/0x8943c7bac1914c9a7aba750bf2b6b09fd21037e0/4147 https://opensea.io/assets/ethereum/0x8943c7bac1914c9a7aba750bf2b6b09fd21037e0/4147] (Dec 4, 2023)</ref>

<ref name="etherscan-12617">[https://etherscan.io/tx/0x38c9238044937e6c4a78404332b9e26e42fa347988c2ef847ef1d29d900b471d Ethereum Transaction Hash (Txhash) Details | Etherscan] (Dec 4, 2023)</ref>

<ref name="etherscan-12618">[https://etherscan.io/tx/0x9bcc5cdecb1822f726f2b91177f5e6b332a6a66beaf5c378f7673f3a9972f4f3 Ethereum Transaction Hash (Txhash) Details | Etherscan] (Dec 4, 2023)</ref>

<ref name="mrraygtwitter-12619">[https://twitter.com/MrRayG/status/1582144428940341248 @MrRayG Twitter] (Dec 4, 2023)</ref>

<ref name="mrraygtwitter-12620">[https://twitter.com/MrRayG/status/1529993260743241728 @MrRayG Twitter] (Dec 5, 2023)</ref>

<ref name="mrraygtwitter-12621">[https://twitter.com/MrRayG/status/1551552014861082624 @MrRayG Twitter] (Dec 5, 2023)</ref>

<ref name="empstudio4twitter-12622">[https://twitter.com/EMPStudio4/status/1530028008308117504 @EMPStudio4 Twitter] (Dec 5, 2023)</ref>

<ref name="mrraygtwitter-12623">[https://twitter.com/MrRayG/status/1535299035971690497 @MrRayG Twitter] (Dec 5, 2023)</ref>

<ref name="mrraygtwitter-12624">[https://twitter.com/MrRayG/status/1557723909759320064 @MrRayG Twitter] (Dec 5, 2023)</ref>

<ref name="mrraygtwitter-12625">[https://twitter.com/MrRayG/status/1557727039209472003 @MrRayG Twitter] (Dec 5, 2023)</ref>

<ref name="mrraygtwitter-12626">[https://twitter.com/MrRayG/status/1531678529783484417 @MrRayG Twitter] (Dec 5, 2023)</ref>

<ref name="baconm77twitter-12627">[https://twitter.com/Baconm77/status/1526600447477395457 @Baconm77 Twitter] (Dec 5, 2023)</ref>

<ref name="etherscan-12628">[https://etherscan.io/tx/0xa2f016ea3ddb8addef10b1f9a0dcf04789fdef4f72925e89e06d543bf0b258bf Ethereum Transaction Hash (Txhash) Details | Etherscan] (Dec 5, 2023)</ref>

<ref name="etherscan-12629">[https://etherscan.io/tx/0x2b2a0583235bedf73b5a0e2dd6e93ba0db6ec17ac2844318c9f2afdb83bd5d27 Ethereum Transaction Hash (Txhash) Details | Etherscan] (Dec 5, 2023)</ref>

<ref name="etherscan-12630">[https://etherscan.io/tx/0xa22f5946081e494a466da377897ff0a728dc3161190c15e0119524c29800b470 Ethereum Transaction Hash (Txhash) Details | Etherscan] (Dec 5, 2023)</ref>

<ref name="etherscan-12631">[https://etherscan.io/tx/0x1c92f7c36ac1a1b90e2875476d44ad62091bc981752495bbb1cb2bc909f4bebf Ethereum Transaction Hash (Txhash) Details | Etherscan] (Dec 5, 2023)</ref>

<ref name="etherscan-12632">[https://etherscan.io/nft-transfers?a=0x93a4c7ca8123551ac3fd14d7f7b646db47b2bb37 NFT Transfers | Etherscan] (Dec 5, 2023)</ref>

<ref name="etherscan-12633">[https://etherscan.io/nft/0x8943c7bac1914c9a7aba750bf2b6b09fd21037e0/1640 #1640 | Lazy Lions | Etherscan] (Dec 5, 2023)</ref>

<ref name="nft-12634">[https://nft.coinbase.com/@baconm77 https://nft.coinbase.com/@baconm77] (Dec 5, 2023)</ref>

<ref name="etherscan-12635">[https://etherscan.io/tx/0xbeee2136346fbf9d17dc4eb9c0718c9fcc3ff14cef0a7e727bc522791d5bb57a Ethereum Transaction Hash (Txhash) Details | Etherscan] (Dec 5, 2023)</ref>

<ref name="nft-12636">[https://nft.coinbase.com/nft/ethereum/0x4db1f25d3d98600140dfc18deb7515be5bd293af/1804 https://nft.coinbase.com/nft/ethereum/0x4db1f25d3d98600140dfc18deb7515be5bd293af/1804] (Dec 5, 2023)</ref>

<ref name="baconm77twitter-12637">[https://twitter.com/Baconm77/status/1526609159281590276 @Baconm77 Twitter] (Dec 5, 2023)</ref>

<ref name="mrraygtwitter-12638">[https://twitter.com/MrRayG/status/1526991345583280130 @MrRayG Twitter] (Dec 5, 2023)</ref>

<ref name="mrraygtwitter-12639">[https://twitter.com/MrRayG/status/1528145540000665602 @MrRayG Twitter] (Dec 5, 2023)</ref>

<ref name="baconm77twitter-12640">[https://twitter.com/Baconm77/status/1528052199309422596 @Baconm77 Twitter] (Dec 5, 2023)</ref>

<ref name="mrraygtwitter-12641">[https://twitter.com/MrRayG/status/1530190627186540549 @MrRayG Twitter] (Dec 5, 2023)</ref>

<ref name="mrraygtwitter-12642">[https://twitter.com/MrRayG/status/1530596962701086720 @MrRayG Twitter] (Dec 5, 2023)</ref></references>

MetaMask Wallet NFT Theft Baconm77/Michael Bode - Revision history