Rare Bears Discord Attack - Revision history

Azoundria: Another 30 minutes complete. Integrated information from a few different sources into the article.

2023-12-19T20:51:43Z

Another 30 minutes complete. Integrated information from a few different sources into the article.

Azoundria at 20:33, 8 December 2023

2023-12-08T20:33:54Z

← Older revision		Revision as of 14:33, 8 December 2023
Line 2:		Line 2:

	[[File:Rarebearsnft.jpg\|thumb\|Rare Bears]]The Rare Bears NFTs are a set of NFT bears made by a New Zealand artist Enox. A security breach in the Discord of the Rare Bears NFT project allowed an attacker to post a malicious phishing link for over 9 hours before the link was finally removed. During that time, an estimated $800k worth of assets were stolen from users. Users who clicked the link and authorized a cheap mint would have had all assets from their wallets taken.		[[File:Rarebearsnft.jpg\|thumb\|Rare Bears]]The Rare Bears NFTs are a set of NFT bears made by a New Zealand artist Enox. A security breach in the Discord of the Rare Bears NFT project allowed an attacker to post a malicious phishing link for over 9 hours before the link was finally removed. During that time, an estimated $800k worth of assets were stolen from users. Users who clicked the link and authorized a cheap mint would have had all assets from their wallets taken.
	<ref name="chubk-8128" /><ref name="rarebearsnft-8507" /><ref name="opensea-8508" /><ref name="mintalytics-8509" /><ref name="mpost-8510" /><ref name="bearsraretwitter-8511" /><ref name="nftevening-8512" /><ref name="cryptopolitan-8513" /><ref name="bearsraretwitter-8514" /><ref name="coincunews-8515" /><ref name="web3isgoinggreat-10404" /><ref name="mstpr0twitter-10411" /><ref name="web3isgreattwitter-10412" /><ref name="cointelegraph-10413" /><ref name="theblock-10414" /><ref name="bearsraretwitter-10409" /><ref name="sueryancamitwitter-10415" /><ref name="bearsraretwitter-10416" /><ref name="punishe32385597twitter-10417" /><ref name="bearsraretwitter-10418" /><ref name="kohlsafttwitter-10419" /><ref name="dubsydoestwitter-10420" /><ref name="huzzaxotwitter-10421" /><ref name="sungin21ctwitter-10422" /><ref name="bearsraretwitter-10423" /><ref name="0xeliestwitter-10424" /><ref name="sirteammtwitter-10425" /><ref name="bearsraretwitter-10426" /><ref name="bearsraretwitter-10427" /><ref name="thiago29404948twitter-10428" /><ref name="artzhytwitter-10429" /><ref name="patel07678843twitter-10430" /><ref name="whyarewehere42twitter-10431" /><ref name="sungin21ctwitter-10432" /><ref name="tripedyblacktwitter-10433" /><ref name="kaianfttwitter-10434" /><ref name="kaianfttwitter-10435" /><ref name="kaianfttwitter-10436" /><ref name="deucephlairtwitter-10437" /><ref name="tripedyblacktwitter-10438" /><ref name="tripedyblacktwitter-10439" /><ref name="etherscan-10440" />		<ref name="chubk-8128" /><ref name="rarebearsnft-8507" /><ref name="opensea-8508" /><ref name="mintalytics-8509" /><ref name="mpost-8510" /><ref name="bearsraretwitter-8511" /><ref name="nftevening-8512" /><ref name="cryptopolitan-8513" /><ref name="bearsraretwitter-8514" /><ref name="coincunews-8515" /><ref name="web3isgoinggreat-10404" /><ref name="mstpr0twitter-10411" /><ref name="web3isgreattwitter-10412" /><ref name="cointelegraph-10413" /><ref name="theblock-10414" /><ref name="bearsraretwitter-10409" /><ref name="sueryancamitwitter-10415" /><ref name="bearsraretwitter-10416" /><ref name="punishe32385597twitter-10417" /><ref name="bearsraretwitter-10418" /><ref name="kohlsafttwitter-10419" /><ref name="dubsydoestwitter-10420" /><ref name="huzzaxotwitter-10421" /><ref name="sungin21ctwitter-10422" /><ref name="bearsraretwitter-10423" /><ref name="0xeliestwitter-10424" /><ref name="sirteammtwitter-10425" /><ref name="bearsraretwitter-10426" /><ref name="bearsraretwitter-10427" /><ref name="thiago29404948twitter-10428" /><ref name="artzhytwitter-10429" /><ref name="patel07678843twitter-10430" /><ref name="whyarewehere42twitter-10431" /><ref name="sungin21ctwitter-10432" /><ref name="tripedyblacktwitter-10433" /><ref name="kaianfttwitter-10434" /><ref name="kaianfttwitter-10435" /><ref name="kaianfttwitter-10436" /><ref name="deucephlairtwitter-10437" /><ref name="tripedyblacktwitter-10438" /><ref name="tripedyblacktwitter-10439" /><ref name="etherscan-10440" /><ref>[https://cointelegraph.com/news/rare-bears-discord-phishing-attack-nabs-800k-in-nfts Rare Bears Discord phishing attack nabs $800K in NFTs - CoinTelegraph] (Jun 21, 2023)</ref><ref>[https://www.theblock.co/post/138250/hacker-steals-790000-of-nfts-and-crypto-from-owners-of-rare-bears Hacker steals $790,000 of NFTs and crypto from owners of Rare Bears - TheBlock] (Jun 21, 2023)</ref>

	== About Rare Bears ==		== About Rare Bears ==

Azoundria: Another 30 minutes complete. Prevention added. Information relocated around.

2023-07-10T16:44:57Z

Another 30 minutes complete. Prevention added. Information relocated around.

Show changes

Azoundria: /* Prevention Policies */

2023-02-22T17:19:16Z

Prevention Policies

← Older revision		Revision as of 11:19, 22 February 2023
Line 195:		Line 195:

	== Prevention Policies ==		== Prevention Policies ==
	{{Prevention:Store funds offline}}		{{Prevention:Individual:Store funds offline}}

	Individual users should never trust information that is only present on a single source, and always back it up by checking a more official source or getting a second opinion from others.		Individual users should never trust information that is only present on a single source, and always back it up by checking a more official source or getting a second opinion from others.

Azoundria: /* Prevention Policies */

2023-02-22T17:18:11Z

Prevention Policies

← Older revision		Revision as of 11:18, 22 February 2023
Line 195:		Line 195:

	== Prevention Policies ==		== Prevention Policies ==
			{{Prevention:Store funds offline}}

	Individual users should never trust information that is only present on a single source, and always back it up by checking a more official source or getting a second opinion from others.		Individual users should never trust information that is only present on a single source, and always back it up by checking a more official source or getting a second opinion from others.

Azoundria at 05:44, 21 February 2023

2023-02-21T05:44:14Z

@@ Line 1: / Line 1: @@
-{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/rarebearsdiscordattack.php}}
+{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/rarebearsdiscordattack.php}}
-{{Unattributed Citations}}
+{{Unattributed Sources}}
 [[File:Rarebearsnft.jpg|thumb|Rare Bears]]The Rare Bears NFTs are a set of NFT bears made by a New Zealand artist Enox. A security breach in the Discord of the Rare Bears NFT project allowed an attacker to post a malicious phishing link for over 9 hours before the link was finally removed. During that time, an estimated $800k worth of assets were stolen from users. Users who clicked the link and authorized a cheap mint would have had all assets from their wallets taken.
 <ref name="chubk-8128" /><ref name="rarebearsnft-8507" /><ref name="opensea-8508" /><ref name="mintalytics-8509" /><ref name="mpost-8510" /><ref name="bearsraretwitter-8511" /><ref name="nftevening-8512" /><ref name="cryptopolitan-8513" /><ref name="bearsraretwitter-8514" /><ref name="coincunews-8515" /><ref name="web3isgoinggreat-10404" /><ref name="mstpr0twitter-10411" /><ref name="web3isgreattwitter-10412" /><ref name="cointelegraph-10413" /><ref name="theblock-10414" /><ref name="bearsraretwitter-10409" /><ref name="sueryancamitwitter-10415" /><ref name="bearsraretwitter-10416" /><ref name="punishe32385597twitter-10417" /><ref name="bearsraretwitter-10418" /><ref name="kohlsafttwitter-10419" /><ref name="dubsydoestwitter-10420" /><ref name="huzzaxotwitter-10421" /><ref name="sungin21ctwitter-10422" /><ref name="bearsraretwitter-10423" /><ref name="0xeliestwitter-10424" /><ref name="sirteammtwitter-10425" /><ref name="bearsraretwitter-10426" /><ref name="bearsraretwitter-10427" /><ref name="thiago29404948twitter-10428" /><ref name="artzhytwitter-10429" /><ref name="patel07678843twitter-10430" /><ref name="whyarewehere42twitter-10431" /><ref name="sungin21ctwitter-10432" /><ref name="tripedyblacktwitter-10433" /><ref name="kaianfttwitter-10434" /><ref name="kaianfttwitter-10435" /><ref name="kaianfttwitter-10436" /><ref name="deucephlairtwitter-10437" /><ref name="tripedyblacktwitter-10438" /><ref name="tripedyblacktwitter-10439" /><ref name="etherscan-10440" /><ref name="acenftalphatwitter-10441" />
@@ Line 11: / Line 9: @@
 "Official is an NFT collection that was created on March 09, 2022." "Iain Spanhake A.K.A Enox is a professional digital artist from New Zealand." "The Rare Bears are 2,347 unique NFTs from digital artist, Enox. The first collection released in March 2022 and our upcoming Mare Bear collection will be dropping in the second half of the year."
 == The Reality ==

Azoundria at 18:16, 15 February 2023

2023-02-15T18:16:29Z

Show changes

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/rarebearsdiscordattack.php}} Rare BearsRare Bears are an NFT set of 2,347 unique bears made by a New Zealand artist nicknamed Enox. The project's Discord server became compromised through the account of one of the moderators, and a fake sale was promoted there. In reality, users who interacted with that site could find their wallets emptied by the permissions they g..."

2023-01-28T16:54:58Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/rarebearsdiscordattack.php}} thumb|Rare BearsRare Bears are an NFT set of 2,347 unique bears made by a New Zealand artist nicknamed Enox. The project's Discord server became compromised through the account of one of the moderators, and a fake sale was promoted there. In reality, users who interacted with that site could find their wallets emptied by the permissions they g..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/rarebearsdiscordattack.php}}

[[File:Rarebearsnft.jpg|thumb|Rare Bears]]Rare Bears are an NFT set of 2,347 unique bears made by a New Zealand artist nicknamed Enox. The project's Discord server became compromised through the account of one of the moderators, and a fake sale was promoted there. In reality, users who interacted with that site could find their wallets emptied by the permissions they gave. A total of 179 NFTs were stolen in the attack. The NFTs were sold, with the proceeds in ethereum being then mixed by TornadoCash. No funds have been recovered, however the project is releasing 50 additional NFTs to affected users as an attempt to make things right.

This is a global/international case not involving a specific country.

== About Rare Bears ==
"The Rare Bears are taking over. They’re cute and sweet, but tough and street. The Bears have a cool retro vibe mixed with a futuristic cyber tone. They’re all about street art, graffiti, music, tech, fashion, and a few old-school video games. They’re down to cuddle once in a while, but if you cross a Bear it’s bad news. The Rare Bears are your ticket into the BearVerse with the most vibrant community around. More NFTs will drop, collabs will happen and more mediums will be explored. We’re bearly getting started."

"Official is an NFT collection that was created on March 09, 2022." "Iain Spanhake A.K.A Enox is a professional digital artist from New Zealand." "The Rare Bears are 2,347 unique NFTs from digital artist, Enox. The first collection released in March 2022 and our upcoming Mare Bear collection will be dropping in the second half of the year."

"Discord seems to be becoming a good “bait” for hackers to carry out phishing attacks on NFT collectors." "Holders of Rare Bears NFTs got scammed on the community’s Discord channel and lost almost $800,000 worth of digital assets in a phishing attack." "[A] new collection of NFT Rare Bears announced that its members had fallen victim to a similar incident and lost more than $790,000 in assets."

"An unidentified person got unauthorized access to the official moderator’s account on the Rare Bears’ server and shared a phishing link." "The fake announcement stated that additional 1,000 unique NFTs priced for 0.1 ETH were added to the collection and are ready to be minted." "The compromised account also invited a bot to lock all channels so no one on the server could warn other members about the NFT fake collection."

"[T]he attacker compromised the project head’s Discord account, who was the owner of the Rare Bears server." "According to a Rare Bears team update, the hacker got access to the account of “Zhodan,” a Rare Bears Discord moderator." "Then, the hacker posted an ‘official’ link in one of the channels, informing about a new release of NFTs. In addition, the unknown person disabled other members’ roles on the server and their ability to write or delete posts and warn about the phishing link."

"The team admitted to having multiple security breaches and confessed not taking appropriate security measures." "After regaining control of the channel and apologizing to the community, the founding members of Rare Bears announced a new member, Discord manager for security audits."

"After realising what had happened, the Rare Bears team managed to regain control of the server. The team members did this by transferring ownership to a new Discord account. They also publicly promised their members that this new account will never interact with members, click any links or accept friend requests."

"A detailed review from Peckshield showed that the hacker stole a combined 179 NFTs from the platform. Asides from the Rare Bears NFT, he was able to get his hands on others, including Azuki and some LAND tokens."

"In a detailed analysis, the hacker was said to have sold all the NFTs, recouping cash worth around $795,000 from the sales." "According to on-chain research, the majority of the NFTs were sold, netting the hacker 286 ETH worth approximately $795,500, the majority of which was immediately sent through Tornado Cash, a crypto mixer used to hide the source of funds." "After the sale, the hacker obfuscated funds through the known mixer, Tornado Cash."

"After the issue was solved, the Rare Bears team decided to compensate Rare Bears community members impacted by the cyberattack: 50 bear NFTs will airdrop on the 22nd of March."

“We are sorry this happened, we care and are trying to make this right as best as we can. We cannot bring back your money, but we can return 50 bears and future benefits,” Rare Bears founders said on Discord.

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Rare Bears Discord Attack
!Date
!Event
!Description
|-
|March 16th, 2022 9:09:00 PM
|Main Event
|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost has been estimated at $795,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
Individual users should never trust information that is only present on a single source, and always back it up by checking a more official source or getting a second opinion from others.

The Rare Bears project could have prevented the situation through tighter security on their Discord.

== References ==
[https://chubk.com/bored-ape-yacht-club-bayc-officially-confirmed-the-projects-discord-channel-has-been-hacked/ Bored Ape Yacht Club (BAYC) officially confirmed the project's Discord channel has been hacked - CryptoHubK] (Jun 19)

[https://rarebearsnft.com/ Rare Bears – Rare Bears NFT collection from digital artist, Enox] (Jul 14)

[https://opensea.io/collection/rarebearsnft-official https://opensea.io/collection/rarebearsnft-official] (Jul 14)

[https://mintalytics.com/collection/rarebearsnft-official/ Rare Bears Nft - Official (RAREBEARS) Charts & Data | Mintalytics] (Jul 14)

[https://mpost.io/rare-bears-nft-discord-hack/ Rare Bears NFT Discord Hack: Almost $800,000 Worth of NFTs Stolen | Metaverse Post] (Jul 14)

[https://twitter.com/BearsRare/status/1504651613910466561 @BearsRare Twitter] (Jul 14)

[https://nftevening.com/rare-bears-nft-discord-hack-scammer-runs-away-with-800k-in-nfts/ Rare Bears NFT Discord Hack: Scammer Runs Away With $800k In NFTs] (Jul 14)

[https://www.cryptopolitan.com/rare-bears-suffers-phishing-attack/ Rare Bears suffers phishing attack] (Jul 14)

[https://twitter.com/BearsRare/status/1504293859467350019 @BearsRare Twitter] (Jul 14)

[https://news.coincu.com/73753-rare-bears-discord-phishing-attack-nabs-800k-in-nfts/ Rare Bears Discord Phishing Attack Nabs $800K In NFTs - CoinCu News] (Jul 14)

[https://web3isgoinggreat.com/?id=2022-03-16-2 Discord hack targeting Rare Bears NFT project nets attacker $800,000] (Jan 26)