Beeple Twitter Account Hack

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Beeple Mint scam website.

Beeple was an extremely successful NFT artist, with works selling for upwards of $69.3m in auctions. On May 22nd, 2022, his Twitter account was compromised and the attackers used their access to launch two separate phishing attacks on his followers, netting them a total of $438k. It does not appear that any of the funds have been recovered.

This is a global/international case not involving a specific country.

About Beeple

Beeple (also known as Mike Winkelmann) was a well known artist and NFT creator from South Carolina who created three of the top ten most expensive NFTs sold to date. One of those, his "first 5,000 days", where he created a new NFT photo for 5,000 days straight, sold for $69.3 million, the most expensive NFT ever sold to a sole owner.

“I almost look at it now like I’m a political cartoonist,” Beeple explains. “Except instead of doing sketches, I’m using the most advanced 3D tools to make comments on current events, almost in real-time.”

Beeple has a strong following of 1.8 million followers and had previously done collaborations with Louis Vuitton, Nike, Katy Perry, and Choldish Gambino. Beeple had recently started collaborating with Louis Vuitton on an NFT project. Earlier in May, NFT creator Beeple designed 30 NFTs for Louis Vuitton’s "Louis The Game" mobile game, which were embedded within the game as player rewards. On the early morning of May 22nd, 2022, the official account of Beeple posted about an exciting new raffle.

"Been working on this with [Louis Vuitton] for a long time behind the scenes. 1000 total unique pieces.

BEEPLE x VUITTON COLLECTION_!: BEEPLES

Official Raffle Below. 1 ETH = 1 Raffle Entry. All non-winning entries are refunded post raffle.

Good luck :)"

This was follows by yet another promotion a couple hours later - this time promising a free mint!

"Had felt the need to release more NFTs from my collection behind the scenes. 200 total unique pieces.

BEEPLE - SPRING/SUMMER COLLECTION 2021

Official Minting Link Below. FREE mint! 200 UNIQUE pieces for everyone!

Good luck :)"

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

Beeple's account had been hacked and the raffle was not real. As explained by Harry Denley (@sniko_), the website was malicious and users who participated in attacks simply forfeited their ETH. The registered IP addresses used in the attacks had previously been involved is numerous malicious websites and scam operations.

"Once you've connected your wallet, will initiate a mint() contract call to 0x7b69c4f2ACF77300025E49DbDbB65B068b2Fda7D, which will send 1ETH to the contract." "As of typing the website is not weaponised to "drain" wallets by filling the wallet tx queue (like we've seen before)" "The contract you are sending a transaction to is in fact a 721 contract, with mint() function defined as: The owner of the contract can withdraw the funds at any moment"

What Happened

Beeple had his Twitter account hacked as part of a phishing scam which posted a fake Louis Vuitton NFT raffle and a free minting scam. Both links would actually drain funds from user's wallets. The phishing links lasted roughly 5 hours before beeple finally woke up.

Key Event Timeline - Beeple Twitter Account Hack

Date	Event	Description
March 11th, 2022 8:02:00 AM	Record NFT Sale	The auction price of Beeple's NFT "EVERYDAYS: THE FIRST 5000 DAYS" exceeds $60m.
May 22nd, 2022 3:20:00 AM	First Exploit	The very first minting transaction happens, stealing ethereum from an account named "legalguy.eth".
May 22nd, 2022 4:24:00 AM	Twitter Report	The first hack is reported on Twitter by Harry Denley (@_sniko). At the time of that tweet, losses were reported as 25 ETH/$50k.
May 22nd, 2022 5:21:00 AM	Second Tweet	The second compromised tweet is posted on Twitter by @beeple's account. It succeeds to have transfers almost immediately.
May 22nd, 2022 5:41:00 AM	Twitter Report	The second hack is reported on Twitter by Harry Denley (@_sniko). "Bad actors continue have access to Beeples Twitter account and they have now tweeted another phishing domain. This one seems a little more sophisticated than the first, having a Discord C2 - still investigating. Potentially targets NFTs with setApprovalForAll()".
May 22nd, 2022 6:19:00 AM	Final Exploit	The final "setApprovalForAll" transaction is done as part of the first phishing attack.
May 22nd, 2022 8:02:00 AM	Final Exploit	The final "setApprovalForAll" transaction is done as part of the second phishing attack.
May 22nd, 2022 8:21:00 AM	Twitter Report	Beeple regains control of their account and posts a tweet "Twitter was hacked but we have control now."

Total Amount Lost

CoinTelegraph reports that the scam earned the attacker $438K in cryptocurrency and NFTs from the compromised Beeple account.

There were multiple phishing links posted through the Beeple account. The first netted roughly $73,000. The second netted $365,000 worth of ethereum and several high profile "from high-value collections such as the Mutant Ape Yacht Club, VeeFriends and Otherdeeds", with the grand total being roughly $438,000.

Security researcher Harry Denley (@sniko_) reached the same total via a slightly different calculation.

"Scam #1

36ETH (~$72k) 0xf305 is yet to withdraw

Scam #2 62.35ETH (~$125k) 37.59WETH (~$75k) 45 NFTs (est ~$166k)

Total = $438k (active for ~5hours)"

The total amount lost has been estimated at $438,000 USD.

Immediate Reactions

Multiple posts were shared by MetaMask Security Analyst Harry Denley (@sniko_) on Twitter to warn other users.

Beeple's Twitter account has been compromised (ATO) to post a phishing website to steal funds.

The second attack was described by Harry Denly as being "a little more sophisticated than the first" because it had "a Discord C2". He noted it might be targeting "NFTs with setApprovalForAll()".

Bad actors continue have access to Beeples Twitter account and they have now tweeted another phishing domain. This one seems a little more sophisticated than the first, having a Discord C2 - still investigating. Potentially targets NFTs with setApprovalForAll().

Examples of victims were Twitter users @Helisegundo and @nfactes:

"Dumbly I have clicked on the link and connected my wallet and been scammed. Damn I've check again and they also stole 2 of my nfts"

"with all due respect but lost 1 eth believing it was a real account. What I should do now?"

Ultimate Outcome

Beeple regained control of his account and posted to announce the fraud, calling it "too good to be true" that there would be a free mint and criticizing those who fell for it.

ugh we’ll that was fun way to wake up.

Twitter was hacked but we have control now. Huge thanks to @garyvee ‘a team for quick help!!!!

Stay safe out there, anything too good to be true IS A FUCKING SCAM.

And as side note, there will never be a SURPRISE MINT I mention one time in one place starting at 6am Sunday morning.

On-chain data shows that the scammer sold their NFTs on OpenSea and put the stolen ethereum into a cryptocurrency mixing service.

Total Amount Recovered

It does not appear that any recovery has been obtained for any users affected. Quoting @super1said:

"They dont Care bro. We are nobody the Guy had more then 156 nfts stolen and alreadly sold more then 80 of them my trust in this shit nfts is getting smaller by the day"

There do not appear to have been any funds recovered in this case.

Ongoing Developments

There don't appear to be any ongoing events remaining.

Prevention Policies

This can be prevented through exercising care whenever interacting with any smart contract or making any payment. The user must ensure that they understand the transaction prior to sending any funds or approvals.