Moonbirds Airdrop Phishing - Revision history

Azoundria: Another 30 minutes complete. Prevention added and much more research.

2023-06-20T20:14:54Z

Another 30 minutes complete. Prevention added and much more research.

← Older revision		Revision as of 14:14, 20 June 2023
Line 1:		Line 1:
	{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/moonbirdsairdropphishing.php}}[[File:Moonbirds.jpg\|thumb\|Moonbirds]]The Moonbirds NFT project suffered an attempted phishing attack. Attackers rebranded an account with 60k followers and used it to promote a supposed airdrop. Victims were taken to another website with a malicious smart contract designed to steal their funds.		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/moonbirdsairdropphishing.php}}[[File:Moonbirds.jpg\|thumb\|Moonbirds]]The Moonbirds NFT project suffered an attempted phishing attack. Attackers rebranded an account with 60k followers and used it to promote a supposed Moonbirds airdrop. Victims were taken to another website with a malicious smart contract designed to steal their funds.

	It is unclear how successful the attack was. It is possible that no funds were taken, since there may have been a limited overlap in followers between the Moonbirds Twitter and the fake account, and commenting was allowed for most of a day which could have warned others about the scam before they participated.		It is unclear how successful the attack was. It is possible that no funds were taken, since there may have been a limited overlap in followers between the Moonbirds Twitter and the fake account, and commenting was allowed for most of a day which could have warned others about the scam before they participated.

	== About Moonbirds ==		== About Moonbirds ==
	<ref name="moonbirds-8853" /><ref name="youtube-8855" />		Proof Collective is a podcast hosted by Kevin Rose<ref name="apewell-9756">[https://web.archive.org/web/20220925085900/https://www.apewell.com/post/what-is-proof-collective-moonbirds What is Proof Collective & Moonbirds? - The Ape Well Archive September 25th, 2022 2:59:00 AM MDT] (Nov 24, 2022)</ref><ref name="youtube-8855" />, a prominent US tech investor and entrepreneur<ref name="raffaelareinmedium-9755">[https://medium.com/@raffaelarein/moonbirds-and-proof-collective-5-learnings-from-hottest-thing-in-nfts-from-a-proof-member-4d99ec273ac2 Moonbirds and Proof collective — 5 Learnings from hottest thing in NFTs (from a Proof member) - Raffaela Rein Medium] (Nov 18, 2022)</ref>. The podcast explores various aspects of the NFT space through interviews with influential figures<ref name="apewell-9756" />. The Proof Collective is a group of NFT collectors and artists who hold a membership NFT, granting them access to a private Discord, early podcast access, IRL (in real life) events, and exclusive collaborations<ref name="apewell-9756" /><ref name="youtube-8855" />.

			Moonbirds are the official profile pictures (PFPs) of the PROOF Collective, with a higher supply than the membership NFT<ref name="apewell-9756" /><ref name="youtube-8855" />. The Proof Collective consists of 1,000 NFT collectors who share investment opportunities and gain access to exclusive whitelists<ref name="raffaelareinmedium-9755" />. The team's experience is reflected in their transparent and consistent communication<ref name="raffaelareinmedium-9755" />. They engage with the community through regular updates, town halls, and seeking input on key decisions. The Proof membership offers utility through various NFT drops, whitelist access, and upcoming in-house NFT analysts<ref name="raffaelareinmedium-9755" />. The team's vision extends to Project Highrise, their own innovative and engaging metaverse, which has generated much excitement<ref name="raffaelareinmedium-9755" />.

			Moonbirds implement a "Proof-of-Time" mechanic to discourage flipping and reward long-term holding<ref name="apewell-9756" />. Users can nest their Moonbird NFTs to accrue points and unlock benefits, which are lost if the NFT is removed from the nest<ref name="apewell-9756" />. The project aims to foster a genuine community through incentivization and engagement<ref name="apewell-9756" />. The Moonbirds project has gained significant value, driven by the desire to be connected to Kevin Rose and the PROOF Collective. The future of the project promises more than just free stickers, with community-driven events and opportunities expected<ref name="apewell-9756" />.

			The strong community behind the Proof Collective played a significant role in the success of Moonbirds<ref name="raffaelareinmedium-9755" />. The collective consists of influential NFT collectors and artists, fostering a supportive and informed environment<ref name="raffaelareinmedium-9755" />. The gated nature of the community ensures streamlined communication and reduced noise compared to other open communities<ref name="raffaelareinmedium-9755" />. In addition to the Proof Membership pass, members received two Moonbirds NFTs, and they had the opportunity to participate in the Grails in-house NFT drop featuring renowned artists<ref name="raffaelareinmedium-9755" />.

			The Proof Collective, known for their Moonbirds NFT project, has become widely recognized in the NFT space due to its impressive launch and performance<ref name="raffaelareinmedium-9755" />. Moonbirds saw a remarkable surge in value, surpassing even popular NFT projects like Bored Ape Yacht Club and CryptoPunks<ref name="raffaelareinmedium-9755" />. The project raised $60 million upon launch and achieved a total trading volume of $238 million<ref name="raffaelareinmedium-9755" />. The team is focused on building products, pushing technological boundaries, and having fun while doing it<ref name="youtube-8855" />.

			The project is described on their homepage<ref name="moonbirds-8853" />, promotional YouTube video<ref name="youtube-8855" />, and OpenSea collection page<ref name="opensea-9759">[https://opensea.io/collection/proof-moonbirds Proof Moonbirds Collection - OpenSea] (Nov 24, 2022)</ref>.<blockquote>Moonbirds are art collectors, creatives, and dreamers. Our community is a home for those seeking real connection as we all contribute to the future of web3 art, culture, and technology.

			To some, the “art world” can feel daunting or stuffy; a cryptic pastime reserved for those with sufficient insight and deep pockets.

			It doesn’t have to be that way. We’re in the midst of a cultural revolution—a digital renaissance—in which art is being transformed into something everyone can appreciate, own, and share. Our goal is to create unique experiences for collectors to connect with artists to own and champion their art. And to have a lot of fun along the way.</blockquote><blockquote>Moonbirds is the art collector’s PFP. Each of the 10,000 digital artworks in the collection grants holders access to unique experiences to connect with artists and own and champion their art. As a community, Moonbirds is a home for creatives, dreamers, and collectors seeking real connection as we all contribute to the future of web3 art, culture, and technology. Moonbird art is entirely in-chain, meaning the images are outputted directly from the smart contract, with no need for storage on IPFS or the like. There are also a number of customisable backgrounds available to holders based on their on-chain activity (such as other NFT holdings)—which disappear when the bird is transferred. You can check what each bird looks like with the different backgrounds (and see if they have any unclaimed rewards!) on our site.</blockquote>


			The speaker emphasizes the importance of artist collaborations and announces plans for more Proof artist collaborations in the future.


			<ref name="youtube-8855" />

	"Moonbirds are more than just an avatar. They're a collection of 10,000 utility-enabled PFPs that feature a richly diverse and unique pool of rarity-powered traits. What's more, each Moonbird unlocks private club membership and additional benefits the longer you hold them. We call it nesting – because, obviously."		"Moonbirds are more than just an avatar. They're a collection of 10,000 utility-enabled PFPs that feature a richly diverse and unique pool of rarity-powered traits. What's more, each Moonbird unlocks private club membership and additional benefits the longer you hold them. We call it nesting – because, obviously."
Line 58:		Line 78:
	!Event		!Event
	!Description		!Description
			\|-
			\|March 4th, 2022 5:22:24 PM MST
			\|Future Proof Published
			\|The Future PROOF video is published. Kevin Rose expresses excitement and gratitude for everyone's presence. He outlines three key areas of focus for the Proof Collective: building products, providing knowledge, and fostering community. He introduces Proof Deep Dives, which will offer concise and actionable PDF reports exclusively for Proof members, covering various NFT projects and launches. He also announces Proof Weekly Highlights, where research analysts will curate important Discord posts and NFT industry news into a weekly PDF summary<ref name="youtube-8855" />.
	\|-		\|-
	\|April 8th, 2022 3:57:00 PM MDT		\|April 8th, 2022 3:57:00 PM MDT
Line 124:		Line 148:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
	== ~~General~~ Prevention Policies ==		== Individual Prevention Policies ==
	Never interact with any project except through that project's official website. Bookmark the official website of every project. Keep the majority of funds offline and never have more funds than necessary in your current active wallet.		Never interact with any project except through that project's official website. Bookmark the official website of every project. Keep the majority of funds offline and never have more funds than necessary in your current active wallet.
	== Individual Prevention ~~Policies ==~~
	{{Prevention:~~Individuals~~:~~Placeholder~~}}		{{Prevention:Individual:Question Unrealistic Profit}}

			{{Prevention:Individual:Double Check Transactions}}

			{{Prevention:Individual:Never Share Private Keys}}

	{{Prevention:Individuals:End}}		{{Prevention:Individuals:End}}

	== Platform Prevention Policies ==		== Platform Prevention Policies ==
	{{Prevention:Platforms:~~Placeholder~~}}		{{Prevention:Platforms:Cryptocurrency Safety Quiz}}

			{{Prevention:Platforms:Establish Industry Insurance Fund}}

	{{Prevention:Platforms:End}}		{{Prevention:Platforms:End}}

	== Regulatory Prevention Policies ==		== Regulatory Prevention Policies ==
	{{Prevention:Regulators:~~Placeholder~~}}		{{Prevention:Regulators:Cryptocurrency Education Mandate}}

			{{Prevention:Regulators:Establish Industry Insurance Fund}}

	{{Prevention:Regulators:End}}		{{Prevention:Regulators:End}}

Azoundria: Initial 30 minutes, all sources sorted through.

2023-04-18T18:12:42Z

Initial 30 minutes, all sources sorted through.

← Older revision		Revision as of 12:12, 18 April 2023
Line 1:		Line 1:
	{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/moonbirdsairdropphishing.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/moonbirdsairdropphishing.php}}[[File:Moonbirds.jpg\|thumb\|Moonbirds]]The Moonbirds NFT project suffered an attempted phishing attack. Attackers rebranded an account with 60k followers and used it to promote a supposed airdrop. Victims were taken to another website with a malicious smart contract designed to steal their funds.
	~~{{Unattributed Sources}}~~

	[[File:Moonbirds.jpg\|thumb\|Moonbirds]]The Moonbirds NFT project suffered an attempted phishing attack. Attackers rebranded an account with 60k followers and used it to promote a supposed airdrop. Victims were taken to another website with a malicious smart contract designed to steal their funds.

	It is unclear how successful the attack was. It is possible that no funds were taken, since there may have been a limited overlap in followers between the Moonbirds Twitter and the fake account, and commenting was allowed for most of a day which could have warned others about the scam before they participated.		It is unclear how successful the attack was. It is possible that no funds were taken, since there may have been a limited overlap in followers between the Moonbirds Twitter and the fake account, and commenting was allowed for most of a day which could have warned others about the scam before they participated.

	~~This is a global/international case not involving a specific country.<ref name~~=~~"malwarebytesblog-8851" /><ref name~~=~~"moonbirdstwitter-8852" />~~<ref name="moonbirds-8853~~" /><ref name="thinksproutinfotech-8854~~" /><ref name="youtube-8855~~" /><ref name="journalofcyberpolicy-8856" /><ref name="malwarebytes-8947~~" />		== About Moonbirds ==
			<ref name="moonbirds-8853" /><ref name="youtube-8855" />

	~~== About Moonbirds ==~~
	"Moonbirds are more than just an avatar. They're a collection of 10,000 utility-enabled PFPs that feature a richly diverse and unique pool of rarity-powered traits. What's more, each Moonbird unlocks private club membership and additional benefits the longer you hold them. We call it nesting – because, obviously."		"Moonbirds are more than just an avatar. They're a collection of 10,000 utility-enabled PFPs that feature a richly diverse and unique pool of rarity-powered traits. What's more, each Moonbird unlocks private club membership and additional benefits the longer you hold them. We call it nesting – because, obviously."

Line 61:		Line 58:
	!Event		!Event
	!Description		!Description
			\|-
			\|April 8th, 2022 3:57:00 PM MDT
			\|Moonbirds Warning Tweet
			\|Moonbirds Tweets a warning "BEWARE of scammers, we don't Instagram, have a public discord, or have any other URL"<ref name="moonbirdstwitter-8852" />.
			\|-
			\|April 18th, 2022 6:55:36 PM MDT
			\|Moonbirds #6544 Stolen
			\|The blockchain transaction for the theft of Moonbird #6544<ref>[https://etherscan.io/tx/0x695b67941f7a219a6c56fef38f6240fc32168474b679083c99d3d79460240d66 Theft Transaction For Moonbirds #6544 - Etherscan] (Apr 18, 2023)</ref>.
			\|-
			\|April 18th, 2022 6:57:25 PM MDT
			\|Moonbirds #6544 Resold
			\|The stolen Moonbird is resold for 18 ETH<ref>[https://etherscan.io/tx/0x357ad03bdee30cb44eee9787c3e3b50a3f6d5729eb5c3d709a5509dae585436a Sale of Moonbirds #6544 - Etherscan] (Apr 18, 2023)</ref>. The floor price at the time is 18.5 ETH<ref name=":0">[https://jsuite.medium.com/how-i-got-my-moonbirds-6544-scammed-which-spiraled-the-best-weekend-of-my-life-into-the-worst-796001ca057a JSuite - How I got my Moonbirds #6544 scammed, which spiraled the best weekend of my life into the worst weekend of my life. - Medium] (Apr 18, 2023)</ref>.
			\|-
			\|April 22nd, 2022
			\|JSuite Blog Post
			\|A blog post covers over the events leading up to the Moonbirds NFT theft, including the Twitter account with 55k followers<ref name=":0" />.
			\|-
			\|April 22nd, 2022 1:59:00 AM MDT
			\|PeckShield Post Twitter Warning
			\|Peckshield reports on the phishing site<ref>[https://twitter.com/PeckShieldAlert/status/1517412889333706752 <nowiki>PeckShield - "PeckShield has detected claim-moonbirds[.]com is a phishing site. Do NOT connect your wallet." - Twitter</nowiki>] (Apr 18, 2023)</ref>.
			\|-
			\|April 23rd, 2022 10:29:00 PM MDT
			\|Twitter Report to Namecheap
			\|Twitter user CryptoHoward reposts the warning and tags Namecheap's Twitter account<ref>[https://twitter.com/CryptoHoward/status/1518084748614463488 CryptoHoward - "Crypto phishing scams threat" - Twitter] (Apr 18, 2023)</ref>.
			\|-
			\|April 23rd, 2022 10:42:00 PM MDT
			\|Namecheap Suspends Account
			\|Namecheap reports that they have suspended the claim-moonbirds.com domain<ref>[https://twitter.com/Namecheap/status/1518088030967451650 Namecheep - "Hello! We have suspended the abusive service" - Twitter] (Apr 18, 2023)</ref>.
	\|-		\|-
	\|April 25th, 2022 2:19:00 PM MDT		\|April 25th, 2022 2:19:00 PM MDT
	\|~~Main Event~~		\|Tweet In MalwareBytes Blog
	\|~~Expand this into a brief description~~ of ~~what happened and~~ the ~~impact~~. ~~If multiple lines are necessary, add them here~~.		\|The timestamp of the tweet in MalwareBytes blog. TBD Unknown timezone<ref name="malwarebytesblog-8851" />.
	\|-		\|-
	\|		\|May 3rd, 2022
	\|		\|MalwareBytes Blog Article
	\|		\|The phishing scam is given special mention in a blog post by MalwareBytes<ref name="malwarebytesblog-8851" />.
			\|-
			\|May 26th, 2022
			\|Techsprout News Article
			\|An article by Techsprout News reports that a total of 29 Moonbirds NFTs have been stolen<ref name="thinksproutinfotech-8854" />. TBD fill in more details.
			\|-
			\|August 18th, 2022
			\|Journal of Cyber Policy
			\|The incident gets honourable mention in a Journal of Cyber Policy<ref name="journalofcyberpolicy-8856" />. TBD fill in more.
	\|}		\|}

Line 81:		Line 114:
	== Ultimate Outcome ==		== Ultimate Outcome ==
	What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?		What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

			The Moonbirds #6544 appears to be blocked from trading on OpenSea due to suspicious activity<ref>[https://opensea.io/assets/ethereum/0x23581767a106ae21c074b2276d25e5c3e136a68b/6544 Moonbird #6544 - OpenSea] (Apr 18, 2023)</ref>.

	== Total Amount Recovered ==		== Total Amount Recovered ==
Line 107:		Line 142:

	== References ==		== References ==
	<references><ref name="malwarebytesblog-8851">[https://blog.malwarebytes.com/crypto/2022/05/airdrop-phishing-what-is-it-and-how-is-my-cryptocurrency-at-risk/ Airdrop phishing: what is it, and how is my cryptocurrency at risk?] (Jul 2, 2022)</ref>		<references>
			<ref name="malwarebytesblog-8851">[https://blog.malwarebytes.com/crypto/2022/05/airdrop-phishing-what-is-it-and-how-is-my-cryptocurrency-at-risk/ Airdrop phishing: what is it, and how is my cryptocurrency at risk? - MalwareBytes] (Jul 2, 2022)</ref>
	<ref name="moonbirdstwitter-8852">[https://twitter.com/moonbirds/status/1512550209108131844 @moonbirds Twitter] (Aug 23, 2022)</ref>		<ref name="moonbirdstwitter-8852">[https://twitter.com/moonbirds/status/1512550209108131844 moonbirds - "BEWARE of scammers, we don't Instagram, have a public discord, or have any other URL other than http://moonbirds.xyz" - Twitter] (Aug 23, 2022)</ref>

	<ref name="moonbirds-8853">[https://www.moonbirds.xyz/ Moonbirds: The official PROOF PFP] (Aug 23, 2022)</ref>		<ref name="moonbirds-8853">[https://www.moonbirds.xyz/ Moonbirds: The official PROOF PFP] (Aug 23, 2022)</ref>

	<ref name="thinksproutinfotech-8854">[https://thinksproutinfotech.com/news/phishing-attack-strikes-moonbirds-nft-project-details-here/ Phishing Attack Strikes ‘Moonbirds’ NFT Project, Details Here - Techsprout News] (Aug 23, 2022)</ref>		<ref name="thinksproutinfotech-8854">[https://thinksproutinfotech.com/news/phishing-attack-strikes-moonbirds-nft-project-details-here/ Phishing Attack Strikes ‘Moonbirds’ NFT Project, Details Here - Techsprout News] (Aug 23, 2022)</ref>

	<ref name="youtube-8855">[https://www.youtube.com/watch?v=MztCb2FJ7tg Future PROOF (edited short edition) - YouTube] (Aug 23, 2022)</ref>		<ref name="youtube-8855">[https://www.youtube.com/watch?v=MztCb2FJ7tg Future PROOF (edited short edition) - YouTube] (Aug 23, 2022)</ref>

	<ref name="journalofcyberpolicy-8856">[https://journalofcyberpolicy.com/airdrop-phishing-is-scamming-crypto-investors-cyber-forensics-net-urge-investors-to-stay-cautious/ Airdrop phishing is scamming crypto investors- Cyber-Forensics.net urge investors to stay cautious - Journal of Cyber Policy] (Aug 23, 2022)</ref>		<ref name="journalofcyberpolicy-8856">[https://journalofcyberpolicy.com/airdrop-phishing-is-scamming-crypto-investors-cyber-forensics-net-urge-investors-to-stay-cautious/ Airdrop phishing is scamming crypto investors- Cyber-Forensics.net urge investors to stay cautious - Journal of Cyber Policy] (Aug 23, 2022)</ref>
			<ref name="malwarebytes-8947">[https://www.malwarebytes.com/blog/news/2022/05/airdrop-phishing-what-is-it-and-how-is-my-cryptocurrency-at-risk Airdrop phishing: what is it, and how is my cryptocurrency at risk?] (Aug 30, 2022)</ref>
	<ref name="malwarebytes-8947">[https://www.malwarebytes.com/blog/news/2022/05/airdrop-phishing-what-is-it-and-how-is-my-cryptocurrency-at-risk Airdrop phishing: what is it, and how is my cryptocurrency at risk?] (Aug 30, 2022)</ref></references>		</references>

Azoundria at 16:10, 12 April 2023

2023-04-12T16:10:49Z

← Older revision		Revision as of 10:10, 12 April 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/moonbirdsairdropphishing.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/moonbirdsairdropphishing.php}}
			{{Unattributed Sources}}

	[[File:Moonbirds.jpg\|thumb\|Moonbirds]]The Moonbirds NFT project suffered an attempted phishing attack. Attackers rebranded an account with 60k followers and used it to promote a supposed airdrop. Victims were taken to another website with a malicious smart contract designed to steal their funds.		[[File:Moonbirds.jpg\|thumb\|Moonbirds]]The Moonbirds NFT project suffered an attempted phishing attack. Attackers rebranded an account with 60k followers and used it to promote a supposed airdrop. Victims were taken to another website with a malicious smart contract designed to steal their funds.
Line 5:		Line 6:
	It is unclear how successful the attack was. It is possible that no funds were taken, since there may have been a limited overlap in followers between the Moonbirds Twitter and the fake account, and commenting was allowed for most of a day which could have warned others about the scam before they participated.		It is unclear how successful the attack was. It is possible that no funds were taken, since there may have been a limited overlap in followers between the Moonbirds Twitter and the fake account, and commenting was allowed for most of a day which could have warned others about the scam before they participated.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.<ref name="malwarebytesblog-8851" /><ref name="moonbirdstwitter-8852" /><ref name="moonbirds-8853" /><ref name="thinksproutinfotech-8854" /><ref name="youtube-8855" /><ref name="journalofcyberpolicy-8856" /><ref name="malwarebytes-8947" />

	== About Moonbirds ==		== About Moonbirds ==
Line 61:		Line 62:
	!Description		!Description
	\|-		\|-
	\|April 25th, 2022 2:19:00 PM		\|April 25th, 2022 2:19:00 PM MDT
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 88:		Line 89:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== General Prevention Policies ==
			Never interact with any project except through that project's official website. Bookmark the official website of every project. Keep the majority of funds offline and never have more funds than necessary in your current active wallet.
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

	== Prevention Policies ==		== Platform Prevention Policies ==
	Never interact with any project except through that project's official website. Bookmark the official website of every project. Keep the majority of funds offline and never have more funds than necessary in your current active wallet.		{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

			{{Prevention:Regulators:End}}

	== References ==		== References ==
	[https://blog.malwarebytes.com/crypto/2022/05/airdrop-phishing-what-is-it-and-how-is-my-cryptocurrency-at-risk/ Airdrop phishing: what is it, and how is my cryptocurrency at risk?] (Jul 2)		<references><ref name="malwarebytesblog-8851">[https://blog.malwarebytes.com/crypto/2022/05/airdrop-phishing-what-is-it-and-how-is-my-cryptocurrency-at-risk/ Airdrop phishing: what is it, and how is my cryptocurrency at risk?] (Jul 2, 2022)</ref>

	[https://twitter.com/moonbirds/status/1512550209108131844 @moonbirds Twitter] (Aug 23)		<ref name="moonbirdstwitter-8852">[https://twitter.com/moonbirds/status/1512550209108131844 @moonbirds Twitter] (Aug 23, 2022)</ref>

	[https://www.moonbirds.xyz/ Moonbirds: The official PROOF PFP] (Aug 23)		<ref name="moonbirds-8853">[https://www.moonbirds.xyz/ Moonbirds: The official PROOF PFP] (Aug 23, 2022)</ref>

	[https://thinksproutinfotech.com/news/phishing-attack-strikes-moonbirds-nft-project-details-here/ Phishing Attack Strikes ‘Moonbirds’ NFT Project, Details Here - Techsprout News] (Aug 23)		<ref name="thinksproutinfotech-8854">[https://thinksproutinfotech.com/news/phishing-attack-strikes-moonbirds-nft-project-details-here/ Phishing Attack Strikes ‘Moonbirds’ NFT Project, Details Here - Techsprout News] (Aug 23, 2022)</ref>

	[https://www.youtube.com/watch?v=MztCb2FJ7tg Future PROOF (edited short edition) - YouTube] (Aug 23)		<ref name="youtube-8855">[https://www.youtube.com/watch?v=MztCb2FJ7tg Future PROOF (edited short edition) - YouTube] (Aug 23, 2022)</ref>

	[https://journalofcyberpolicy.com/airdrop-phishing-is-scamming-crypto-investors-cyber-forensics-net-urge-investors-to-stay-cautious/ Airdrop phishing is scamming crypto investors- Cyber-Forensics.net urge investors to stay cautious - Journal of Cyber Policy] (Aug 23)		<ref name="journalofcyberpolicy-8856">[https://journalofcyberpolicy.com/airdrop-phishing-is-scamming-crypto-investors-cyber-forensics-net-urge-investors-to-stay-cautious/ Airdrop phishing is scamming crypto investors- Cyber-Forensics.net urge investors to stay cautious - Journal of Cyber Policy] (Aug 23, 2022)</ref>

	[https://www.malwarebytes.com/blog/news/2022/05/airdrop-phishing-what-is-it-and-how-is-my-cryptocurrency-at-risk Airdrop phishing: what is it, and how is my cryptocurrency at risk?] (Aug 30)		<ref name="malwarebytes-8947">[https://www.malwarebytes.com/blog/news/2022/05/airdrop-phishing-what-is-it-and-how-is-my-cryptocurrency-at-risk Airdrop phishing: what is it, and how is my cryptocurrency at risk?] (Aug 30, 2022)</ref></references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/moonbirdsairdropphishing.php}} MoonbirdsThe Moonbirds NFT project suffered an attempted phishing attack. Attackers rebranded an account with 60k followers and used it to promote a supposed airdrop. Victims were taken to another website with a malicious smart contract designed to steal their funds. It is unclear how successful the attack was. It is possible that no fun..."

2023-01-29T03:36:18Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/moonbirdsairdropphishing.php}} thumb|MoonbirdsThe Moonbirds NFT project suffered an attempted phishing attack. Attackers rebranded an account with 60k followers and used it to promote a supposed airdrop. Victims were taken to another website with a malicious smart contract designed to steal their funds. It is unclear how successful the attack was. It is possible that no fun..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/moonbirdsairdropphishing.php}}

[[File:Moonbirds.jpg|thumb|Moonbirds]]The Moonbirds NFT project suffered an attempted phishing attack. Attackers rebranded an account with 60k followers and used it to promote a supposed airdrop. Victims were taken to another website with a malicious smart contract designed to steal their funds.

It is unclear how successful the attack was. It is possible that no funds were taken, since there may have been a limited overlap in followers between the Moonbirds Twitter and the fake account, and commenting was allowed for most of a day which could have warned others about the scam before they participated.

This is a global/international case not involving a specific country.

== About Moonbirds ==
"Moonbirds are more than just an avatar. They're a collection of 10,000 utility-enabled PFPs that feature a richly diverse and unique pool of rarity-powered traits. What's more, each Moonbird unlocks private club membership and additional benefits the longer you hold them. We call it nesting – because, obviously."

"Once inside, you will have exclusive access to Moonbird-related drops, Parliament meetups and IRL events, and access to upcoming PROOF projects; including the PROOF metaverse, codenamed Highrise."

"The money collected by via this Moonbirds project goes to PROOF Holdings, a True Ventures backed Web3 media company that brings together NFT artists and creators."

“We have big plans and this funding will be used solely to expand our team and launch new products — ultimately creating additional value for our community,” the project website says.

"BEWARE of scammers, we don't Instagram, have a public discord, or have any other URL other than http://moonbirds.xyz"

"To celebrate almost 60k followers on our official twitter account, we want to give you the biggest airdrop in the history of the NFT community. To find out more, go to the airdrop page."

"When people started calling out the tweet, they locked people’s ability to reply under the guise of “safety” so nobody else could highlight the scam."

"Birds, we are worried about your safety, and until Elon buys Twitter and stops these crazy scammers, we are closing comments to keep you safe. Will be open in 48 hours."

"The link opened to a fake airdrop page. Few people realized the scam until they read Moonbirds’ verified account and put up a post to beware of the scammers."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Moonbirds Airdrop Phishing
!Date
!Event
!Description
|-
|April 25th, 2022 2:19:00 PM
|Main Event
|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
Never interact with any project except through that project's official website. Bookmark the official website of every project. Keep the majority of funds offline and never have more funds than necessary in your current active wallet.

== References ==
[https://blog.malwarebytes.com/crypto/2022/05/airdrop-phishing-what-is-it-and-how-is-my-cryptocurrency-at-risk/ Airdrop phishing: what is it, and how is my cryptocurrency at risk?] (Jul 2)

[https://twitter.com/moonbirds/status/1512550209108131844 @moonbirds Twitter] (Aug 23)

[https://www.moonbirds.xyz/ Moonbirds: The official PROOF PFP] (Aug 23)

[https://thinksproutinfotech.com/news/phishing-attack-strikes-moonbirds-nft-project-details-here/ Phishing Attack Strikes ‘Moonbirds’ NFT Project, Details Here - Techsprout News] (Aug 23)

[https://www.youtube.com/watch?v=MztCb2FJ7tg Future PROOF (edited short edition) - YouTube] (Aug 23)

[https://journalofcyberpolicy.com/airdrop-phishing-is-scamming-crypto-investors-cyber-forensics-net-urge-investors-to-stay-cautious/ Airdrop phishing is scamming crypto investors- Cyber-Forensics.net urge investors to stay cautious - Journal of Cyber Policy] (Aug 23)

[https://www.malwarebytes.com/blog/news/2022/05/airdrop-phishing-what-is-it-and-how-is-my-cryptocurrency-at-risk Airdrop phishing: what is it, and how is my cryptocurrency at risk?] (Aug 30)