Moonbirds NFT Trading Fraud - Revision history

Azoundria: Another 30 minutes complete.

2023-06-09T19:34:00Z

Another 30 minutes complete.

← Older revision		Revision as of 13:34, 9 June 2023
Line 1:		Line 1:
	{{~~Imported~~ Case Study ~~2\|source=https://www.quadrigainitiative.com/casestudy/moonbirdsnfttradingfraud.php~~}}[[File:Moonbirds.jpg\|thumb\|Moonbirds]]One holder of many Moonbirds NFTs, who happens to be a father with young children, was befriended by an online "trader" who later offered to purchase his NFTs. However, the "trader" directed him to use a malicious website to facilitate the trade. This website was able to steal all his NFTs (worth $1.5m) after he granted it permission.		{{Case Study Under Construction}}[[File:Moonbirds.jpg\|thumb\|Moonbirds]]One holder of many Moonbirds NFTs, who happens to be a father with young children, was befriended by an online "trader" who later offered to purchase his NFTs. However, the "trader" directed him to use a malicious website to facilitate the trade. This website was able to steal all his NFTs (worth $1.5m) after he granted it permission.

	The "trader" did not do a very good job of covering their tracks and had interacted with multiple exchange platforms previously, so their identity was likely compromised. They were requested to return the funds. There is no clear word if any NFTs were returned.		The "trader" did not do a very good job of covering their tracks and had interacted with multiple exchange platforms previously, so their identity was likely compromised. They were requested to return the funds. There is no clear word if any NFTs were returned.
Line 64:		Line 64:
	* Anything that wasn't reasonably knowable at the time of the event.		* Anything that wasn't reasonably knowable at the time of the event.
	There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.		There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

			== About P2Peers NFT Exchange ==
			P2Peers gave the impression of being a simple and safe trading platform, with simple instructions for users to perform an NFT trade<ref name=":0">[https://web.archive.org/web/20220430030806/https://p2peers.io/ P2Peers Homepage Archive April 29th, 2022 9:08:06 PM MDT] (Jun 9, 2023)</ref>.<blockquote>Easily EXCHANGE your NFTs with p2peers. Simple. Safe. Reliable. Your NFT swapping platform p2peers many2many NFTs in a safe and a easy way.</blockquote>The website provided simple instructions for users on how they could complete their NFT swap<ref name=":0" />.<blockquote>Approve your NFTs.

			To make swapping possible, we need to be able to transfer tokens on your behalf and only once per contract.

			Propose the swap.

			To propose the swap you need to select the NFTs you want to trade and fill in the counterparts address on the input field

			Accept the swap.

			The last step to swapping your NFTs is accepting the swap after getting an offer from the counterparty</blockquote>The website featured a logo, elaborate "roadmap" timeline of upcoming development, and requests to follow social media accounts of the exchange.

	== The Reality ==		== The Reality ==
	~~Incog Guide:~~<ref name="guyincognitoilvtwitter-8861" />		P2Peers was a fraudulent exchange platform<ref name="andehxbttwitter-8865" />, which was designed to trick the user into giving up wallet permissions. Once users approved what they thought was a simple trade, their entire wallet could be drained<ref name="andehxbttwitter-8865" /><ref name="guyincognitoilvtwitter-8861" />. Minimal information was provided on the website about who was behind the service.

	~~This sections is included if a case involved deception or information that~~ was ~~unknown at the time. Examples include:~~		The P2Peers platform was owned and operated by an individual with a shady past involving multiple previous frauds<ref name="andehxbttwitter-8865" />.

	* When the service was actually started (if different than the "official story").
	* Who actually ran a ~~service and their own personal history.~~
	* How the service was structured behind the scenes. (For example, there was no "~~trading bot~~".)
	* Details of what audits reported and how vulnerabilities were missed during auditing.

	== What Happened ==		== What Happened ==
	~~The specific events of the loss and how it came about. What actually happened~~ to ~~cause the loss and some~~ of ~~the events leading up to it~~.		A scammer tricked multiple Moonbirds NFT holders into using a questionable NFT trading platform to sell their NFTs, which ultimately robbed them of all NFTs held in their wallets.
	{\| class="wikitable"		{\| class="wikitable"
	\|+Key Event Timeline - Moonbirds NFT Trading Fraud		\|+Key Event Timeline - Moonbirds NFT Trading Fraud
Line 105:		Line 113:
	\|May 25th, 2022 4:00:00 AM MDT		\|May 25th, 2022 4:00:00 AM MDT
	\|Warning About Trading Platform		\|Warning About Trading Platform
	\|Another notice and analysis is shared by Twitter user Andeh<ref name="andehxbttwitter-8865" />. TBD review and add details.		\|Another notice and analysis is shared by Twitter user Andeh<ref name="andehxbttwitter-8865" />. The trading platform used TBD review and add details.
	\|-		\|-
	\|May 25th, 2022 6:30:00 AM MDT		\|May 25th, 2022 6:30:00 AM MDT
Line 119:		Line 127:
	\|The incident is referenced by NFTherder in response to a post claiming "these scams are so dumb"<ref name="nftherdertwitter-9749" />.		\|The incident is referenced by NFTherder in response to a post claiming "these scams are so dumb"<ref name="nftherdertwitter-9749" />.
	\|}		\|}

			== Technical Details ==
			The scam was conducted using the website p2peers.io

			This is the official Tx. ➼

			@DVincent_ (hacker) wallet is (0x7ccf) and he is now approved as the operator of the victims wallet (0x5afcab) to transfer from the Moonbirds contract. ➼ I don't have evidence on how this happened, probably an approval function on the website.

			➼ He goes on to transfer 29 Moonbird NFTs from victims wallet to his in less than 5 hours. ➼ He also takes other NFT's also.

			This is @Dvincent_ (hacker) NFT wallet in Debank. ➼ He has just under $700k estimated value worth of NFTs after this attack. ➼ He also has other PROOF collection NFT's from the same victim.

			I couldn't find @Dvincent_ on the internet, it was too hard. ➼ I was able to lookup the <nowiki>http://p2peers.io</nowiki> website he used, and it was been involved in MANY scams. ➼ As expected, most of the owner details are hidden. ➼ We do see the registrar is <nowiki>http://sarek.fi</nowiki>

			Then, I did a lookup of the <nowiki>http://sarek.fi</nowiki> domain registrar servers: ➼ This website was started in 2019. ➼ Belongs to an address in Finland. ➼ Owner is (recorded as) Sarek Oy and his telephone / mailing address is public.

			➼ Both <nowiki>http://sarek.fi</nowiki> AND <nowiki>http://p2peers.io</nowiki> have been used in previous scams. ➼ I am actively searching for ways to continue this investigation but this may be a deadend until more is found.

			<ref name="andehxbttwitter-8865" />

			Here are some associated wallets with the hacker: ➼0xe8250Bb4eFa6D9d032f7d46393CEaE18168A6B0D ➼0x8e73fe4d5839c60847066b67ea657a67f42a0adf ➼0x6035B92fd5102b6113fE90247763e0ac22bfEF63 ➼0xBf41EFdD1b815556c2416DcF427f2e896142aa53 ➼0x29C80c2690F91A47803445c5922e76597D1DD2B6

	== Total Amount Lost ==		== Total Amount Lost ==
Line 141:		Line 170:
	== Total Amount Recovered ==		== Total Amount Recovered ==
	The total amount recovered is unknown.		The total amount recovered is unknown.

	~~What funds were recovered? What funds were reimbursed for those affected users?~~

	== Ongoing Developments ==		== Ongoing Developments ==
	~~What parts of~~ this ~~case are still remaining~~ to be ~~concluded?~~		It is likely that this individual is known to authorities and being pursued, however it is unclear to what stage any investigation would be in.
	== ~~General~~ Prevention Policies ==		== Individual Prevention Policies ==
	When trading, never use a new exchange platform without first obtaining multiple credible recommendations. Bookmark the official website of every exchange. Keep the majority of funds offline and never have more funds than necessary in your current active wallet.		When trading, never use a new exchange platform without first obtaining multiple credible recommendations. Bookmark the official website of every exchange. Keep the majority of funds offline and never have more funds than necessary in your current active wallet.

	~~Our framework would provide for an easy list of platforms which can be used safely, and a method of handling any issues with those platforms losing assets.~~		{{Prevention:Individual:Question Unrealistic Profit}}
	~~== Individual Prevention Policies ==~~
	{{Prevention:~~Individuals~~:~~Placeholder~~}}		{{Prevention:Individual:Safe Smart Contract Usage}}

	{{Prevention:Individuals:End}}		{{Prevention:Individuals:End}}

	== Platform Prevention Policies ==		== Platform Prevention Policies ==
	{{Prevention:Platforms:~~Placeholder~~}}		{{Prevention:Platforms:Cryptocurrency Safety Quiz}}

			{{Prevention:Platforms:Regular Audit Procedures}}

	{{Prevention:Platforms:End}}		{{Prevention:Platforms:End}}

	== Regulatory Prevention Policies ==		== Regulatory Prevention Policies ==
	{{Prevention:Regulators:~~Placeholder~~}}		{{Prevention:Regulators:Cryptocurrency Education Mandate}}

			{{Prevention:Regulators:Platform Security Assessments}}

			An easy list of platforms which can be used safely, and a method of handling any issues with those platforms losing assets could be provided.

			{{Prevention:Regulators:Establish Industry Insurance Fund}}

	{{Prevention:Regulators:End}}		{{Prevention:Regulators:End}}

Azoundria: All sources resolved. Initial 30 minute completed.

2023-04-13T19:09:35Z

All sources resolved. Initial 30 minute completed.

Show changes

Azoundria at 16:12, 12 April 2023

2023-04-12T16:12:32Z

← Older revision		Revision as of 10:12, 12 April 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/moonbirdsnfttradingfraud.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/moonbirdsnfttradingfraud.php}}
			{{Unattributed Sources}}

	[[File:Moonbirds.jpg\|thumb\|Moonbirds]]One holder of many Moonbirds NFTs, who happens to be a father with young children, was befriended by an online "trader" who later offered to purchase his NFTs. However, the "trader" directed him to use a malicious website to facilitate the trade. This website was able to steal all his NFTs (worth $1.5m) after he granted it permission.		[[File:Moonbirds.jpg\|thumb\|Moonbirds]]One holder of many Moonbirds NFTs, who happens to be a father with young children, was befriended by an online "trader" who later offered to purchase his NFTs. However, the "trader" directed him to use a malicious website to facilitate the trade. This website was able to steal all his NFTs (worth $1.5m) after he granted it permission.
Line 5:		Line 6:
	The "trader" did not do a very good job of covering their tracks and had interacted with multiple exchange platforms previously, so their identity was likely compromised. They were requested to return the funds. There is no clear word if any NFTs were returned.		The "trader" did not do a very good job of covering their tracks and had interacted with multiple exchange platforms previously, so their identity was likely compromised. They were requested to return the funds. There is no clear word if any NFTs were returned.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.<ref name="moonbirds-8853" /><ref name="thinksproutinfotech-8854" /><ref name="youtube-8855" /><ref name="cirrusnfttwitter-8857" /><ref name="guyincognitoilvtwitter-8858" /><ref name="nftan0ntwitter-8859" /><ref name="ourielohayontwitter-8860" /><ref name="guyincognitoilvtwitter-8861" /><ref name="cointelegraph-8862" /><ref name="crypt0savagetwitter-8863" /><ref name="cirrusnfttwitter-8864" /><ref name="andehxbttwitter-8865" /><ref name="looksrare-8866" /><ref name="etherscan-8867" /><ref name="0x22d7twitter-8868" /><ref name="talbeerysectwitter-8869" /><ref name="nftherdertwitter-9749" />

	== About Moonbirds ==		== About Moonbirds ==
Line 81:		Line 82:
	!Description		!Description
	\|-		\|-
	\|May 24th, 2022 8:59:00 PM		\|May 24th, 2022 8:59:00 PM MDT
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 108:		Line 109:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== General Prevention Policies ==
	== Prevention Policies ==
	When trading, never use a new exchange platform without first obtaining multiple credible recommendations. Bookmark the official website of every exchange. Keep the majority of funds offline and never have more funds than necessary in your current active wallet.		When trading, never use a new exchange platform without first obtaining multiple credible recommendations. Bookmark the official website of every exchange. Keep the majority of funds offline and never have more funds than necessary in your current active wallet.

	Our framework would provide for an easy list of platforms which can be used safely, and a method of handling any issues with those platforms losing assets.		Our framework would provide for an easy list of platforms which can be used safely, and a method of handling any issues with those platforms losing assets.
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

			== Platform Prevention Policies ==
			{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

			{{Prevention:Regulators:End}}

	== References ==		== References ==
	[https://www.moonbirds.xyz/ Moonbirds: The official PROOF PFP] (Aug 23)		<references><ref name="moonbirds-8853">[https://www.moonbirds.xyz/ Moonbirds: The official PROOF PFP] (Aug 23, 2022)</ref>

	[https://thinksproutinfotech.com/news/phishing-attack-strikes-moonbirds-nft-project-details-here/ Phishing Attack Strikes ‘Moonbirds’ NFT Project, Details Here - Techsprout News] (Aug 23)		<ref name="thinksproutinfotech-8854">[https://thinksproutinfotech.com/news/phishing-attack-strikes-moonbirds-nft-project-details-here/ Phishing Attack Strikes ‘Moonbirds’ NFT Project, Details Here - Techsprout News] (Aug 23, 2022)</ref>

	[https://www.youtube.com/watch?v=MztCb2FJ7tg Future PROOF (edited short edition) - YouTube] (Aug 23)		<ref name="youtube-8855">[https://www.youtube.com/watch?v=MztCb2FJ7tg Future PROOF (edited short edition) - YouTube] (Aug 23, 2022)</ref>

	[https://twitter.com/CirrusNFT/status/1529296043547865088 @CirrusNFT Twitter] (Aug 23)		<ref name="cirrusnfttwitter-8857">[https://twitter.com/CirrusNFT/status/1529296043547865088 @CirrusNFT Twitter] (Aug 23, 2022)</ref>

	[https://twitter.com/GuyIncognitoILV/status/1529345626059972608 @GuyIncognitoILV Twitter] (Aug 23)		<ref name="guyincognitoilvtwitter-8858">[https://twitter.com/GuyIncognitoILV/status/1529345626059972608 @GuyIncognitoILV Twitter] (Aug 23, 2022)</ref>

	[https://twitter.com/NFTAN0N/status/1529301532637704192 @NFTAN0N Twitter] (Aug 23)		<ref name="nftan0ntwitter-8859">[https://twitter.com/NFTAN0N/status/1529301532637704192 @NFTAN0N Twitter] (Aug 23, 2022)</ref>

	[https://twitter.com/OurielOhayon/status/1529332553806667778 @OurielOhayon Twitter] (Aug 23)		<ref name="ourielohayontwitter-8860">[https://twitter.com/OurielOhayon/status/1529332553806667778 @OurielOhayon Twitter] (Aug 23, 2022)</ref>

	[https://twitter.com/GuyIncognitoILV/status/1517044944061726720 @GuyIncognitoILV Twitter] (Aug 23)		<ref name="guyincognitoilvtwitter-8861">[https://twitter.com/GuyIncognitoILV/status/1517044944061726720 @GuyIncognitoILV Twitter] (Aug 23, 2022)</ref>

	[https://cointelegraph.com/news/nft-owners-reminded-to-be-vigilant-after-29-moonbirds-were-stolen-by-clicking-a-bad-link NFT owners reminded to be vigilant after 29 Moonbirds were stolen by clicking a bad link] (Aug 23)		<ref name="cointelegraph-8862">[https://cointelegraph.com/news/nft-owners-reminded-to-be-vigilant-after-29-moonbirds-were-stolen-by-clicking-a-bad-link NFT owners reminded to be vigilant after 29 Moonbirds were stolen by clicking a bad link - CoinTelegraph] (Aug 23, 2022)</ref>

	[https://twitter.com/crypt0savage/status/1529299195043135489 @crypt0savage Twitter] (Aug 23)		<ref name="crypt0savagetwitter-8863">[https://twitter.com/crypt0savage/status/1529299195043135489 @crypt0savage Twitter] (Aug 23, 2022)</ref>

	[https://twitter.com/CirrusNFT/status/1529299194577420289 @CirrusNFT Twitter] (Aug 23)		<ref name="cirrusnfttwitter-8864">[https://twitter.com/CirrusNFT/status/1529299194577420289 @CirrusNFT Twitter] (Aug 23, 2022)</ref>

	[https://twitter.com/andehxbt/status/1529401905990242304 @andehxbt Twitter] (Aug 23)		<ref name="andehxbttwitter-8865">[https://twitter.com/andehxbt/status/1529401905990242304 @andehxbt Twitter] (Aug 23, 2022)</ref>

	[https://looksrare.org/collections/0x0217a10f9508939680fd0E1288d66Dc581021319/2#activity A hoot for you (#2) - hoots \| LooksRare] (Aug 23)		<ref name="looksrare-8866">[https://looksrare.org/collections/0x0217a10f9508939680fd0E1288d66Dc581021319/2#activity A hoot for you (#2) - hoots \| LooksRare] (Aug 23, 2022)</ref>

	[https://etherscan.io/token/0x23581767a106ae21c074b2276d25e5c3e136a68b?a=0x5afcabcbfeed16ea120a9d3c7c52d0212dda8111 https://etherscan.io/token/0x23581767a106ae21c074b2276d25e5c3e136a68b?a=0x5afcabcbfeed16ea120a9d3c7c52d0212dda8111] (Aug 23)		<ref name="etherscan-8867">[https://etherscan.io/token/0x23581767a106ae21c074b2276d25e5c3e136a68b?a=0x5afcabcbfeed16ea120a9d3c7c52d0212dda8111 https://etherscan.io/token/0x23581767a106ae21c074b2276d25e5c3e136a68b?a=0x5afcabcbfeed16ea120a9d3c7c52d0212dda8111] (Aug 23, 2022)</ref>

	[https://twitter.com/0x22d7/status/1529302601052827649 @0x22d7 Twitter] (Aug 23)		<ref name="0x22d7twitter-8868">[https://twitter.com/0x22d7/status/1529302601052827649 @0x22d7 Twitter] (Aug 23, 2022)</ref>

	[https://twitter.com/TalBeerySec/status/1529439778218835969 @TalBeerySec Twitter] (Aug 23)		<ref name="talbeerysectwitter-8869">[https://twitter.com/TalBeerySec/status/1529439778218835969 @TalBeerySec Twitter] (Aug 23, 2022)</ref>

	[https://twitter.com/NFTherder/status/1530947853643816962 @NFTherder Twitter] (Nov 24)		<ref name="nftherdertwitter-9749">[https://twitter.com/NFTherder/status/1530947853643816962 @NFTherder Twitter] (Nov 24, 2022)</ref></references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/moonbirdsnfttradingfraud.php}} MoonbirdsOne holder of many Moonbirds NFTs, who happens to be a father with young children, was befriended by an online "trader" who later offered to purchase his NFTs. However, the "trader" directed him to use a malicious website to facilitate the trade. This website was able to steal all his NFTs (worth $1.5m) after he granted it permis..."

2023-01-29T03:41:37Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/moonbirdsnfttradingfraud.php}} thumb|MoonbirdsOne holder of many Moonbirds NFTs, who happens to be a father with young children, was befriended by an online "trader" who later offered to purchase his NFTs. However, the "trader" directed him to use a malicious website to facilitate the trade. This website was able to steal all his NFTs (worth $1.5m) after he granted it permis..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/moonbirdsnfttradingfraud.php}}

[[File:Moonbirds.jpg|thumb|Moonbirds]]One holder of many Moonbirds NFTs, who happens to be a father with young children, was befriended by an online "trader" who later offered to purchase his NFTs. However, the "trader" directed him to use a malicious website to facilitate the trade. This website was able to steal all his NFTs (worth $1.5m) after he granted it permission.

The "trader" did not do a very good job of covering their tracks and had interacted with multiple exchange platforms previously, so their identity was likely compromised. They were requested to return the funds. There is no clear word if any NFTs were returned.

This is a global/international case not involving a specific country.

== About Moonbirds ==
"Moonbirds are more than just an avatar. They're a collection of 10,000 utility-enabled PFPs that feature a richly diverse and unique pool of rarity-powered traits. What's more, each Moonbird unlocks private club membership and additional benefits the longer you hold them. We call it nesting – because, obviously."

"Once inside, you will have exclusive access to Moonbird-related drops, Parliament meetups and IRL events, and access to upcoming PROOF projects; including the PROOF metaverse, codenamed Highrise."

"The money collected by via this Moonbirds project goes to PROOF Holdings, a True Ventures backed Web3 media company that brings together NFT artists and creators."

“We have big plans and this funding will be used solely to expand our team and launch new products — ultimately creating additional value for our community,” the project website says.

"Keith said that [someone] befriended him on Twitter weeks ago, and they sometimes spoke via DMs on the website about Moonbirds, until he offered to buy his NFTs on Tuesday night."

"29 Moonbirds were just stolen in a hack. ~750e (~$1,500,000) in value lost by clicking on a bad link."

"A Proof Collective member has fallen victim to a scam, losing 29 highly-valuable Ethereum (ETH)-based Moonbirds. According to a tweet by Cirrus on Wednesday morning, the victim lost 29 Moonbird nonfungible tokens (NFTs) worth $1.5 million after clicking a malicious link shared by a scammer."

The scammer “hacked a father of three children under 6-years-old and a wife, and took all their hard earned money for the past 38 years accrued in a few minutes," the victim said.

"The victim, who goes by Keith “Digital Ornithologist" on Twitter, told Motherboard that the hacker sent him to a phishing website set up with a smart contract, which he approved."

“On that site [the hacker] had a contract made to un-nest all my Moonbirds and move them in one swoop,” he said in an online chat, adding that at first it appeared the transactions were failing but eventually went through.

“No words can describe the level of life altering results this has caused,” he said. “I'm a doctor that takes care of patients with end stage pain (cancer) and have done much for the web3 community to thrive and grow.”

"Sounds like the scammer linked the victim to a fake trading site and got him to sign a bad transaction. Hard wallets dont stop this. Please always be wary of what you are signing when confirming a transaction."

“The hackers tried to be more ‘stealth’ in the beginning and use a smart contract in the transaction for the victim to sign, but when they failed to operate it they resorted to using their ‘regular’ address (not a contract) convince the victim to sign again and it worked,” Tal Be’ery, who is the chief technology officer of ZenGo, a crypto wallet app, said.

"Ethereum blockchain explorer Etherscan shows the flurry of transactions from the victim’s wallet to the hacker in the last few hours. The 29 NFTs are flagged for “suspicious activity” on NFT trading platform OpenSea."

"This guy is really lucky, all of the moonbirds has been frozen so he will get them back. May this be a wise lesson."

"The wallet with the stolen birds just got airdropped this notice..."

"Please return the stolen moonbirds to the original owner. Keep 1 for compensation. If MBs are not returned by 5/25 @ 12p UTC, the police and FBI will be notified formally."

"That'll be a long shot. What moonbirds team can do is threaten to destroy the NFT he had stolen and becomes worthless. From now on, each of the stolen NFT must be watermarked by the team as STOLEN. So secondary buyers will be aware."

"The hacker’s alleged Twitter account has since been deleted."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Moonbirds NFT Trading Fraud
!Date
!Event
!Description
|-
|May 24th, 2022 8:59:00 PM
|Main Event
|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost has been estimated at $1,500,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
The total amount recovered is unknown.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
When trading, never use a new exchange platform without first obtaining multiple credible recommendations. Bookmark the official website of every exchange. Keep the majority of funds offline and never have more funds than necessary in your current active wallet.

Our framework would provide for an easy list of platforms which can be used safely, and a method of handling any issues with those platforms losing assets.

== References ==
[https://www.moonbirds.xyz/ Moonbirds: The official PROOF PFP] (Aug 23)

[https://thinksproutinfotech.com/news/phishing-attack-strikes-moonbirds-nft-project-details-here/ Phishing Attack Strikes ‘Moonbirds’ NFT Project, Details Here - Techsprout News] (Aug 23)

[https://www.youtube.com/watch?v=MztCb2FJ7tg Future PROOF (edited short edition) - YouTube] (Aug 23)

[https://twitter.com/CirrusNFT/status/1529296043547865088 @CirrusNFT Twitter] (Aug 23)

[https://twitter.com/GuyIncognitoILV/status/1529345626059972608 @GuyIncognitoILV Twitter] (Aug 23)

[https://twitter.com/NFTAN0N/status/1529301532637704192 @NFTAN0N Twitter] (Aug 23)

[https://twitter.com/OurielOhayon/status/1529332553806667778 @OurielOhayon Twitter] (Aug 23)

[https://twitter.com/GuyIncognitoILV/status/1517044944061726720 @GuyIncognitoILV Twitter] (Aug 23)

[https://cointelegraph.com/news/nft-owners-reminded-to-be-vigilant-after-29-moonbirds-were-stolen-by-clicking-a-bad-link NFT owners reminded to be vigilant after 29 Moonbirds were stolen by clicking a bad link] (Aug 23)

[https://twitter.com/crypt0savage/status/1529299195043135489 @crypt0savage Twitter] (Aug 23)

[https://twitter.com/CirrusNFT/status/1529299194577420289 @CirrusNFT Twitter] (Aug 23)

[https://twitter.com/andehxbt/status/1529401905990242304 @andehxbt Twitter] (Aug 23)

[https://looksrare.org/collections/0x0217a10f9508939680fd0E1288d66Dc581021319/2#activity A hoot for you (#2) - hoots | LooksRare] (Aug 23)

[https://etherscan.io/token/0x23581767a106ae21c074b2276d25e5c3e136a68b?a=0x5afcabcbfeed16ea120a9d3c7c52d0212dda8111 https://etherscan.io/token/0x23581767a106ae21c074b2276d25e5c3e136a68b?a=0x5afcabcbfeed16ea120a9d3c7c52d0212dda8111] (Aug 23)

[https://twitter.com/0x22d7/status/1529302601052827649 @0x22d7 Twitter] (Aug 23)

[https://twitter.com/TalBeerySec/status/1529439778218835969 @TalBeerySec Twitter] (Aug 23)

[https://twitter.com/NFTherder/status/1530947853643816962 @NFTherder Twitter] (Nov 24)