OpenSea Phishing Attack: Difference between revisions

From Quadriga Initiative Cryptocurrency Hacks, Scams, and Frauds Repository
Jump to navigation Jump to search
No edit summary
(Another 30 minutes complete. Analyzing and integrating different sources.)
 
(5 intermediate revisions by the same user not shown)
Line 1: Line 1:
{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/openseaphishingattack.php}}
{{Case Study Under Construction}}{{Unattributed Sources}}
{{Unattributed Citations}}


[[File:Opensea.jpg|thumb|OpenSea]]Multiple users on the OpenSea platform were the subject of a phishing attack, from an unknown vector. OpenSea is still investigating, and hasn't been able to determine the cause. It is reported that some of the NFT tokens were returned by the attacker, while others were sold, and the proceeds mixed through TornadoCash.
[[File:Opensea.jpg|thumb|OpenSea Homepage/Logo]]Several OpenSea users reported that NFTs had disappeared from their accounts. A total of 254 different NFTs were taken from 17 separate accounts, including valuable Decentraland and Bored Ape Yacht Club NFTs. OpenSea posted an official tweet to community that they are investigating the situation and believe that it's a phishing attack. It is unclear if any of the funds have been recovered.
 
<ref name="theverge2-6997" /><ref name="dunexyz-6998" /><ref name="dfinzertwitter2-6999" /><ref name="coindesk-7000" /><ref name="zdnet-7001" /><ref name="cointelegraph-7002" /><ref name="cnet-7003" /><ref name="threatpost-7004" /><ref name="openseatwitter2-7005" /><ref name="openseatwitter3-7006" /><ref name="openseatwitter4-7007" /><ref name="coinyuppie-7234" /><ref name="cpomagazine-7315" /><ref name="nfttransferaway-8646" /><ref name="tenderlytracer-8647" /><ref name="talbeerysectwitter-8648" /><ref name="gadgets360-10518" /><ref name="openseatwitterannouncement-10519" />
This is a global/international case not involving a specific country.
<ref name="slowmisthacked-2069" /><ref name="opensea-6981" /><ref name="youtube-6982" /><ref name="openseadocs-6983" /><ref name="openseadocs-6984" /><ref name="opensea-6985" /><ref name="theverge-6986" /><ref name="googledoc-6987" /><ref name="youtube-6988" /><ref name="web3isgoinggreat-6989" /><ref name="jonhqtwitter-6990" /><ref name="ajfromdiscordtwitter-6991" /><ref name="mikeburgersburgtwitter-6992" /><ref name="etherscan-6993" /><ref name="openseatwitter-6994" /><ref name="dfinzertwitter-6995" /><ref name="nesotualtwitter-6996" /><ref name="theverge-6997" /><ref name="dune-6998" /><ref name="dfinzertwitter-6999" /><ref name="coindesk-7000" /><ref name="zdnet-7001" /><ref name="cointelegraph-7002" /><ref name="cnet-7003" /><ref name="threatpost-7004" /><ref name="openseatwitter-7005" /><ref name="openseatwitter-7006" /><ref name="openseatwitter-7007" /><ref name="coinyuppie-7234" /><ref name="cpomagazine-7315" /><ref name="etherscan-8646" /><ref name="dashboard-8647" /><ref name="talbeerysectwitter-8648" /><ref name="gadgets360-10518" /><ref name="openseatwitter-10519" /><ref name="nadavahollandertwitter-10520" /><ref name="thinksproutinfotech-8854" />


== About OpenSea ==
== About OpenSea ==
Line 16: Line 13:
"Valued at $13 billion in a recent funding round, OpenSea has become one of the most valuable companies of the NFT boom, providing a simple interface for users to list, browse, and bid on tokens without interacting directly with the blockchain."
"Valued at $13 billion in a recent funding round, OpenSea has become one of the most valuable companies of the NFT boom, providing a simple interface for users to list, browse, and bid on tokens without interacting directly with the blockchain."


Homepage:<ref name="opensea-6981" />
About:<ref name="openseaabout-6985" />
Documentation:<ref name="openseadocs-6983" />
Frequently Asked Questions:<ref name="openseafaq-6984" />
YouTube Promotion:<ref name="openseayoutube-6982" />
Explanation of NFTs:<ref name="youtubenfts-6988" />
== The Reality ==
While self-custody is incredibly powerful, great power requires great responsibility. Users need to educate themselves on how to properly secure their funds. The cleverness of phishing attackers is not to be underestimated.
== What Happened ==
On February 19th, 2022, a handful of OpenSea users reported that valuable NFTs had been stolen from them. Many others feared that the same fate could happen to them - and it could, if they fell for the same phishing attack. This was one of the most successful phishing attacks against OpenSea users with 254 NFTs taken from 17 different users, including valuable Decentraland and Bored Ape Yacht Club NFTs. The bulk of the attacks took place between 5PM and 8PM Eastern Time.
{| class="wikitable"
|+Key Event Timeline - OpenSea Phishing Attack
!Date
!Event
!Description
|-
|February 19th, 2022 4:10:37 PM MST
|AJFromDiscord Malicious Transfer
|AJFromDiscord's 8 NFTs are taken<ref>[https://etherscan.io/tx/0x631c4620ae70c9a01322f5c951c26d1d428fd91542a6b07e8d0526040e262fe4 Malicious Transfer of AJFromDiscord's NFTs - Etherscan] (Apr 6, 2023)</ref>, which include Fighter #3635, Fighter #3634, Hero #3097, Azuki #7916, Azuki #746, PXQuest Adventurer #4331, TheCurrency #1757, and TheCurrency #2634. All NFTs end up at an account which has been nicknamed Fake_Phishing5169.
|-
|February 19th, 2022 4:57:00 PM MST
|AJFromDiscord Tweet
|Twitter user AJFromDiscord (Alabaster Jefferson) posts that he's connected with others who also got hacked and links to a transaction which was executed<ref name="ajfromdiscordtwitter-6991" />. (TBD more details.)
|-
|February 19th, 2022 5:30:00 PM MST
|Jon_HQ Twitter Post
|Twitter user Jon_HQ makes a post which is widely cited, with the first report of a malicious transaction stealing funds<ref name="jonhqtwitter-6990" />. (TBD more detail).
|-
|February 19th, 2022 6:13:00 PM MST
|MikeBurgersburg Analysis Tweet
|Twitter user MikeBurgersburg posts a more detailed breakdown of the transaction flow and what he believes happened<ref name="mikeburgersburgtwitter-6992" />. (TBD more details).
|-
|February 19th, 2022 7:25:50 PM MST
|Neso Technical Analysis Tweet
|Twitter user Nesotual shares a technical analysis of the exploit in a series of tweets<ref name="nesotualtwitter-6996" />. Nesotual clarified the OpenSea (OS) incident, explaining that the attacker orchestrated a phishing attack by having users sign half of a valid Wyvern order. The order was essentially empty, except for the target (attacker contract) and calldata. The attacker then signed the other half of the order, calling their own contract with calldata, including the valid order, address, and transfer calldata for all NFTs approved on the Wyvern (OpenSea) contract. By exploiting the flexibility of Wyvern contracts, the attacker tricked users into approving unintended transactions, leading to the loss of NFTs. Nesotual emphasized that all affected transactions had valid signatures, debunking claims of users not falling victim to phishing but losing NFTs.
|-
|February 19th, 2022 7:33:00 PM MST
|Web3isGoingGreat
|The incident makes the news in Web3isGoingGreat<ref name="web3isgoinggreat-6989" /><ref name=":0">[https://twitter.com/web3isgreat/status/1495225094549172225 <nowiki>web3isgreat - "[UPDATE]: OpenSea users panic as at least $1.7 million in NFTs are stolen" - Twitter</nowiki>] (Apr 6, 2023)</ref>.
|-
|February 19th, 2022 8:53:00 PM MST
|Devin Finzer Tweet
|In a tweet, Devin Finzer, co-founder of OpenSea, addresses concerns about a potential security breach. According to Finzer, the incident seems to be a phishing attack, not directly connected to the OpenSea website. Approximately 32 users fell victim to the attack, signing a malicious payload, resulting in the theft of some NFTs. The attack appears inactive for the past two hours, and some stolen NFTs have been returned. OpenSea is conducting an investigation and urges affected users to reach out for assistance. Finzer emphasized the importance of verifying interaction with the official OpenSea website and dispelled rumors of a $200 million hack, clarifying that the attacker holds $1.7 million worth of ETH from selling stolen NFTs<ref name="dfinzertwitter-6995" />.
|-
|February 20th, 2022 7:37:00 AM MST
|The Verge Article
|An article is published in The Verge, indicating that $1.7m had been lost in the attack<ref name="theverge-6986" />. (TBD expand with more detail.)
|-
|February 20th, 2022 12:02:00 PM
|OpenSea Tweet
|OpenSea posts and official tweet to community that they are investigating the situation and believe that it's a phishing attack<ref name="openseatwitterannouncement-10519" />. They include that it's an "isolated incident impacting a small number of people", "does not appear to be email-based", and that "[t]he migration tool is safe to use"<ref name="openseatwitterannouncement-10519" />.
|-
|February 20th, 2022 2:23:00 PM MST
|Nadav Hollander Technical Analysis
|Twitter user Nadav Hollander investigates and reports that "[n]one of the malicious orders were executed against the new (Wyvern 2.3) contract, indicating that they were signed before the migration and are unlikely to be related to OpenSea’s migration flow."<ref name="nadavahollandertwitter-10520" />
|-
|February 20th, 2022 10:06:00 PM MST
|Narrowed To 17 Victimes
|OpenSea posts that they've narrowed down the list of affected users to just 17<ref name="openseatwitter-6994" />.
|-
|May 26th, 2022 3:02:55 AM MDT
|Techsprout News Article
|The attack is mentioned briefly at the end of a Techsprout News article<ref name="thinksproutinfotech-8854" />.
|}
== Technical Details ==
The Wyvern smart contract which governs OpenSea swaps is highly flexible, and can be used for more complex order types than just transferring a single NFT. The attacker created a malicious smart contract, which authorized the attacker to have access to all the NFTs in any wallet which approved the contract. Through a phishing campaign, they then tricked 17 users into authorizing that smart contract. This allowed them to acquire 254 different NFTs, many of which were liquidated.
=== Creation of Smart Contract ===
"The Zhifan security team analyzed and found that [a] hacker address 0x3E0…8A74 created a smart contract 0xa2…45bD at 9:31:12 (UTC) on January 22, one month ago."
"The Zhifan security team analyzed and found that [a] hacker address 0x3E0…8A74 created a smart contract 0xa2…45bD at 9:31:12 (UTC) on January 22, one month ago."


"Panic erupted on February 19 as a few users saw their wallets emptied of valuable NFTs without knowing why, and many others feared the same could happen to them." "[A]ttackers stole hundreds of NFTs from OpenSea users, causing a late-night panic among the site’s broad user base. A spreadsheet compiled by the blockchain security service PeckShield counted 254 tokens stolen over the course of the attack, including tokens from Decentraland and Bored Ape Yacht Club, with the bulk of the attacks taking place between 5PM and 8PM ET."
"The attack appears to have exploited a flexibility in the Wyvern Protocol, the open-source standard underlying most NFT smart contracts, including those made on OpenSea. One explanation (linked by CEO Devin Finzer on Twitter) described the attack in two parts: first, targets signed a partial contract, with a general authorization and large portions left blank. With the signature in place, attackers completed the contract with a call to their own contract, which transferred ownership of the NFTs without payment. In essence, targets of the attack had signed a blank check — and once it was signed, attackers filled in the rest of the check to take their holdings."
 
"A number of users posted a warning on Twitter this morning that the new migration contract launched by OpenSea yesterday was suspected of having a bug, and the attacker used the bug to steal a large amount of NFT and sell more than 0 ~$3.4 million) NFTs, most of which have been deposited in TornadoCash." "Early explanations blamed a new contract that OpenSea had rolled out, or an airdrop from a new NFT marketplace called X2Y2. People urged NFT owners to revoke permissions for both the OpenSea contract and for X2Y2 until more was known, although one of the most popular websites helping people do so went down shortly after from the high traffic."
=== Phishing Campaign Launched ===
"[M]any details of the attack remain unclear — particularly the method attackers used to get targets to sign the half-empty contract. Writing on Twitter shortly before 3AM ET, OpenSea CEO Devin Finzer said the attacks had not originated from OpenSea’s website, its various listing systems, or any emails from the company. The rapid pace of the attack — hundreds of transactions in a matter of hours — suggests some common vector of attack, but so far no link has been discovered."
 
The "attacker had successfully phished 17 OpenSea users into signing a malicious contract, which allowed the attacker to take the NFTs and then flip them."
 
Twitter user @NadavAHollander explains the exploit further:
 
"None of the malicious orders were executed against the new (Wyvern 2.3) contract, indicating that they were signed before the migration and are unlikely to be related to OpenSea’s migration flow."


"OpenSea was in the process of updating its contract system when the attack took place, but OpenSea has denied that the attack originated with the new contracts. The relatively small number of targets makes such a vulnerability unlikely, since any flaw in the broader platform would likely be exploited on a far greater scale."
Unclear: <ref>[https://web.archive.org/web/20220220024006/https://twitter.com/Nesotual/status/1495225428537233414 Nesotual - "Million and one ways to phish someone, but the private key to the addresses that owned the nfts signed a hash for the exploit order at some point, you can be certain of that." - Twitter Archive February 19th, 2022 7:40:06 PM MST] (Dec 19, 2023)</ref>


"An hour and a half after users began to report missing NFTs, OpenSea finally acknowledged the issue. They tweeted that they were "actively investigating rumors of an exploit associated with OpenSea related smart contracts", and wrote that they believed it was a phishing attack coming from outside of OpenSea, rather than an issue with their contract."
=== Neso Technical Analysis ===
Twitter user Nesotual was one of the first to publish a technical analysis of the exploit<ref name="nesotualtwitter-6996" />. Their explanation was shared by OpenSea co-founder Devin Finzer in his initial tweet<ref name="dfinzertwitter-6995" />.<blockquote>Seen confusion about the OS thing so.


"It was later determined that an attacker had successfully phished 17 OpenSea users into signing a malicious contract, which allowed the attacker to take the NFTs and then flip them."
Attacker had people sign half of a valid wyvern order, the order was basically empty except the target (attacker contract) and calldata, attacker signs other half of order.


"The attack appears to have exploited a flexibility in the Wyvern Protocol, the open-source standard underlying most NFT smart contracts, including those made on OpenSea. One explanation (linked by CEO Devin Finzer on Twitter) described the attack in two parts: first, targets signed a partial contract, with a general authorization and large portions left blank. With the signature in place, attackers completed the contract with a call to their own contract, which transferred ownership of the NFTs without payment. In essence, targets of the attack had signed a blank check — and once it was signed, attackers filled in the rest of the check to take their holdings."
Attacker calls their own contract with calldata including the valid order AND address + transfer calldata for all the NFTs the target has approved on the wyvern (opensea) contract.


“I checked every transaction,” said [one] user, who goes by Neso. “They all have valid signatures from the people who lost NFTs so anyone claiming they didn’t get phished but lost NFTs is sadly wrong.”
The nft address + transfer calldata is saved then the signed order is sent to the wyvern contract atomicmatch, it checks the orders is valid (it is) and signatures are correct for the maker and taker (they are)


"Hackers return most of the unsold NFTs to victims." "Bizarrely, the hacker returned some of the NFTs to their original owners, and one victim inexplicably received 50 ETH ($130,000) from the attacker as well as some of his stolen NFTs back. The attacker later transferred 1,115 ETH obtained from the attack to a cryptocurrency tumbler, worth around $2.9 million."
Now wyvern is past order validation, it calls the proxy contract your OS approvals are on, then that delegatecalls the target contract (attacker) with the calldata in the order (the target and calldata in most orders is the NFT you're buying/selling and the transferFrom call)


"OpenSea co-founder and CEO Devin Finzer confirmed the phishing attack in a tweet." "Afterwards, Devin Finzer confirmed that this was a “phishing attack”, but it has not been possible to verify where the “phishing” occurred. The only thing that can be confirmed after investigation is that the phishing attack did not come from the inside of the OpenSea website."
in this case it goes back to a different function in the attacker contract that then loops the previously saved transfer calldata + token addresses in the context of the proxy contract that has the user approvals.


"Molly White, who runs the blog Web3 is Going Great, estimated the value of the stolen tokens at more than $1.7 million." "OpenSea initially said 32 users had been affected, but later revised that number to 17, saying 15 of the initial count had interacted with the attacker but not lost tokens as a result."
All nfts gone GG. I checked every tx, they all have valid signatures from the people who lost NFTs so anyone claiming they didn't get phished but lost NFTs is sadly wrong.


"[M]any details of the attack remain unclear — particularly the method attackers used to get targets to sign the half-empty contract. Writing on Twitter shortly before 3AM ET, OpenSea CEO Devin Finzer said the attacks had not originated from OpenSea’s website, its various listing systems, or any emails from the company. The rapid pace of the attack — hundreds of transactions in a matter of hours — suggests some common vector of attack, but so far no link has been discovered."
The wyvern contracts are extremely flexible, opensea validates orders on their frontend/api to ensure what you're signing will function as expected, but the same contracts can still be used by others with more complex orders like this that if you sign can take everything approved</blockquote>


"We're reaching out to the folks who reported this to investigate. Please continue to be vigilant when prompted with a wallet signature."
=== Nadav Hollander Technical Analysis ===
Nadav Hollander published a technical analysis of the phishing attack<ref name="nadavahollandertwitter-10520" />.<blockquote>1) Sharing a technical run-down of the phishing attacks targeting @OpenSea users, including some web3 technical education.


This is a global/international case not involving a specific country.
2) After reviewing the malicious orders, the following data points stand out:


The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.
- All of the malicious orders contain valid signatures from the affected users, indicating that they did sign an order somewhere, at some point in time. However, none of these orders were broadcasted to OpenSea at the time of signing.


Include:
- None of the malicious orders were executed against the new (Wyvern 2.3) contract, indicating that they were signed before the migration and are unlikely to be related to OpenSea’s migration flow.


* Known history of when and how the service was started.
- 32 users had NFTs stolen over a relatively short time period. This is extremely unfortunate, but suggests a targeted attack as opposed to a systemic issue.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.


Don't Include:
3) This information, coupled with our discussions with impacted users and investigation by security experts, suggests a phishing operation that was executed ahead of the deprecation of the 2.2 contract given the impending invalidation of these collected malicious orders.
* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.


== The Reality ==
4) Prior to the current phishing scam, part of why we elected to implement EIP-712 on the new contract is that EIP-712’s typed data feature makes it much more difficult for bad actors to trick someone into signing an order without realizing it.
"A number of users posted a warning on Twitter [on the] morning [of February 19th] that the new migration contract launched by OpenSea yesterday was suspected of having a bug, and the attacker used the bug to steal a large amount of NFT and sell more than 0 ~$3.4 million) NFTs, most of which have been deposited in TornadoCash." "Early explanations blamed a new contract that OpenSea had rolled out, or an airdrop from a new NFT marketplace called X2Y2. People urged NFT owners to revoke permissions for both the OpenSea contract and for X2Y2 until more was known, although one of the most popular websites helping people do so went down shortly after from the high traffic."


"OpenSea was in the process of updating its contract system when the attack took place, but OpenSea has denied that the attack originated with the new contracts. The relatively small number of targets makes such a vulnerability unlikely, since any flaw in the broader platform would likely be exploited on a far greater scale."
5) For example, if you are signing a message to join a whitelist, a raffle, or a token-gated discord group and you're presented with a typed data payload referencing Wyvern (the protocol used by OpenSea), it's much more likely to alert you to something unusual going on.


== What Happened ==
6) Education on not sharing seed phrases or submitting unknown transactions has become more widespread in our space. However, signing off-chain messages requires equal consideration.
"Panic erupted on February 19 as a few users saw their wallets emptied of valuable NFTs without knowing why, and many others feared the same could happen to them." "[A]ttackers stole hundreds of NFTs from OpenSea users, causing a late-night panic among the site’s broad user base. A spreadsheet compiled by the blockchain security service PeckShield counted 254 tokens stolen over the course of the attack, including tokens from Decentraland and Bored Ape Yacht Club, with the bulk of the attacks taking place between 5PM and 8PM ET."


"An hour and a half after users began to report missing NFTs, OpenSea finally acknowledged the issue. They tweeted that they were "actively investigating rumors of an exploit associated with OpenSea related smart contracts", and wrote that they believed it was a phishing attack coming from outside of OpenSea, rather than an issue with their contract."
7) We as a community must move to standardizing off-chain signatures using EIP-712 typed data or other agreed-upon standards like EIP-4361 (the "Sign in with Ethereum" method).


"It was later determined that an attacker had successfully phished 17 OpenSea users into signing a malicious contract, which allowed the attacker to take the NFTs and then flip them."
8) On this point, you'll notice that all new orders signed on OpenSea (including migrated orders) use the new EIP-712 format — a change of any kind is understandably scary, but this change actually makes signing much safer as you can better see what you're signing.


"The attack appears to have exploited a flexibility in the Wyvern Protocol, the open-source standard underlying most NFT smart contracts, including those made on OpenSea. One explanation (linked by CEO Devin Finzer on Twitter) described the attack in two parts: first, targets signed a partial contract, with a general authorization and large portions left blank. With the signature in place, attackers completed the contract with a call to their own contract, which transferred ownership of the NFTs without payment. In essence, targets of the attack had signed a blank check — and once it was signed, attackers filled in the rest of the check to take their holdings."
9) Big shoutout to @nesotual, @dguido, @quantstamp, and many others for providing detailed information on the nature of the attack to the community.


"[M]any details of the attack remain unclear — particularly the method attackers used to get targets to sign the half-empty contract. Writing on Twitter shortly before 3AM ET, OpenSea CEO Devin Finzer said the attacks had not originated from OpenSea’s website, its various listing systems, or any emails from the company. The rapid pace of the attack — hundreds of transactions in a matter of hours — suggests some common vector of attack, but so far no link has been discovered."
10) Additionally, even though it appears the attack was made from outside OpenSea, we are actively helping affected users and discussing ways to provide them additional assistance.</blockquote>


Twitter user @NadavAHollander explains the exploit further:
== Total Amount Lost ==


"None of the malicious orders were executed against the new (Wyvern 2.3) contract, indicating that they were signed before the migration and are unlikely to be related to OpenSea’s migration flow."
There were reported losses of 254 NFTs across 17 different user accounts, including highly valuable Decentraland and Bored Ape Yacht Club NFTs.


=== List of NFTs Taken ===
{| class="wikitable"
{| class="wikitable"
|+Key Event Timeline - OpenSea Phishing Attack
|+An Incomplete List Of NFTs Taken
!Date
!NFT
!Event
!Time Taken
!Description
!Victim
!New Account
!Approximate Value
|-
|Fighter #3635
|February 19th, 2022 4:10:37 PM MST
|AJFromDiscord
|Fake_Phishing5169
|
|-
|Fighter #3634
|February 19th, 2022 4:10:37 PM MST
|AJFromDiscord
|Fake_Phishing5169
|
|-
|Hero #3097
|February 19th, 2022 4:10:37 PM MST
|AJFromDiscord
|Fake_Phishing5169
|
|-
|Azuki #7916
|February 19th, 2022 4:10:37 PM MST
|AJFromDiscord
|Fake_Phishing5169
|
|-
|Azuki #746
|February 19th, 2022 4:10:37 PM MST
|AJFromDiscord
|Fake_Phishing5169
|
|-
|PXQuest Adventurer #4331
|February 19th, 2022 4:10:37 PM MST
|AJFromDiscord
|Fake_Phishing5169
|
|-
|TheCurrency #1757
|February 19th, 2022 4:10:37 PM MST
|AJFromDiscord
|Fake_Phishing5169
|
|-
|-
|February 19th, 2022 6:38:00 PM
|TheCurrency #2634
|Main Event
|February 19th, 2022 4:10:37 PM MST
|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
|AJFromDiscord
|Fake_Phishing5169
|
|-
|-
|February 20th, 2022 12:02:00 PM
|
|OpenSea Tweet
|
|OpenSea posts and official tweet to community that they are investigating the situation and believe that it's a phishing attack.
|Shalerhouser?
|
|TBD - Check for losses from Shalerhouser<ref name=":1">[https://twitter.com/shalerhouser/status/1508138970890350599 Shalerhouser - "Are you guys doing anything to help make this right with customers like me that lost our NFTs???" - Twitter] (Dec 19, 2023)</ref>
|}
|}


== Total Amount Lost ==
=== Loss Estimates ===
"Molly White, who runs the blog Web3 is Going Great, estimated the value of the stolen tokens at more than $1.7 million." "OpenSea initially said 32 users had been affected, but later revised that number to 17, saying 15 of the initial count had interacted with the attacker but not lost tokens as a result."
Web3isGoingGreat<ref name=":0" /> and Devin Finzer<ref name="dfinzertwitter-6995" /> originally estimated the loss at $1.7m, however later revised the estimate to $2.9m<ref name="web3isgoinggreat-6989" />.<blockquote>"Molly White, who runs the blog Web3 is Going Great, estimated the value of the stolen tokens at more than $1.7 million." "OpenSea initially said 32 users had been affected, but later revised that number to 17, saying 15 of the initial count had interacted with the attacker but not lost tokens as a result."</blockquote>SlowMist estimated the loss amount at $3.4m<ref>[https://web.archive.org/web/20230406213510/https://hacked.slowmist.io/?c=&page=18 SlowMist Hack List Page 18 - SlowMist] (Apr 6, 2023)</ref>.
 
A list of stolen NFTs has been published on a Google Sheet<ref>[https://web.archive.org/web/20220412195159/https://docs.google.com/spreadsheets/d/1XQNIXuAl2E1XO_cP8pm_vbzskI_Pka4E5sizfcrLITM/edit Opensea Phishing Incident Stole NFT List - Google Sheet Archive] (Apr 6, 2023)</ref>, however the list has subsequently been removed<ref name="peckshieldlist-6987" />.


The total amount lost has been estimated at $3,400,000 USD.
The total amount lost has been estimated at $3,400,000 USD.


== Immediate Reactions ==
== Immediate Reactions ==
“I checked every transaction,” said [one] user, who goes by Neso. “They all have valid signatures from the people who lost NFTs so anyone claiming they didn’t get phished but lost NFTs is sadly wrong.”
"Panic erupted on February 19 as a few users saw their wallets emptied of valuable NFTs without knowing why, and many others feared the same could happen to them." "[A]ttackers stole hundreds of NFTs from OpenSea users, causing a late-night panic among the site’s broad user base. A spreadsheet compiled by the blockchain security service PeckShield counted 254 tokens stolen over the course of the attack, including tokens from Decentraland and Bored Ape Yacht Club, with the bulk of the attacks taking place between 5PM and 8PM ET."


"OpenSea co-founder and CEO Devin Finzer confirmed the phishing attack in a tweet." "Afterwards, Devin Finzer confirmed that this was a “phishing attack”, but it has not been possible to verify where the “phishing” occurred. The only thing that can be confirmed after investigation is that the phishing attack did not come from the inside of the OpenSea website."


On official statement was released by OpenSea at the time.


"Our leadership, engineering, and security teams are communicating with affected users to gather details. We continue to believe that this is a phishing attack that originated outside of http://opensea.io."
"A number of users posted a warning on Twitter [on the] morning [of February 19th] that the new migration contract launched by OpenSea yesterday was suspected of having a bug, and the attacker used the bug to steal a large amount of NFT and sell more than 0 ~$3.4 million) NFTs, most of which have been deposited in TornadoCash." "Early explanations blamed a new contract that OpenSea had rolled out, or an airdrop from a new NFT marketplace called X2Y2. People urged NFT owners to revoke permissions for both the OpenSea contract and for X2Y2 until more was known, although one of the most popular websites helping people do so went down shortly after from the high traffic."


== Ultimate Outcome ==
"An hour and a half after users began to report missing NFTs, OpenSea finally acknowledged the issue. They tweeted that they were "actively investigating rumors of an exploit associated with OpenSea related smart contracts", and wrote that they believed it was a phishing attack coming from outside of OpenSea, rather than an issue with their contract."
"Hackers return most of the unsold NFTs to victims." "Bizarrely, the hacker returned some of the NFTs to their original owners, and one victim inexplicably received 50 ETH ($130,000) from the attacker as well as some of his stolen NFTs back. The attacker later transferred 1,115 ETH obtained from the attack to a cryptocurrency tumbler, worth around $2.9 million."


=== Devin Finzer Initial Tweet ===
In an initial tweet, Devin Finzer, co-founder of OpenSea, addressed some concerns. According to Finzer, the incident seems to be a phishing attack, not directly connected to the OpenSea website. Approximately 32 users fell victim to the attack, signing a malicious payload, resulting in the theft of some NFTs. The attack appears inactive for the past two hours, and some stolen NFTs have been returned. OpenSea is conducting an investigation and urges affected users to reach out for assistance. Finzer emphasized the importance of verifying interaction with the official OpenSea website and dispelled rumors of a $200 million hack, clarifying that the attacker holds $1.7 million worth of ETH from selling stolen NFTs<ref name="dfinzertwitter-6995" />.<blockquote>I know you’re all worried. We’re running an all hands on deck investigation, but I want to take a minute to share the facts as I see them:


As far as we can tell, this is a phishing attack. We don’t believe it’s connected to the OpenSea website. It appears 32 users thus far have signed a malicious payload from an attacker, and some of their NFTs were stolen.


== Total Amount Recovered ==
The attack doesn’t appear to be active at this point — we haven’t seen any malicious activity from the attacker’s account in 2 hours. Some of the NFTs have been returned.
"Hackers return most of the unsold NFTs to victims." "Bizarrely, the hacker returned some of the NFTs to their original owners, and one victim inexplicably received 50 ETH ($130,000) from the attacker as well as some of his stolen NFTs back. The attacker later transferred 1,115 ETH obtained from the attack to a cryptocurrency tumbler, worth around $2.9 million."


The total amount recovered has been estimated at $1,700,000 USD.
We are not aware of any recent phishing emails that have been sent to users, but at this time we do not know which website was tricking users into maliciously signing messages.


== Ongoing Developments ==
Always double check that you are interacting with <nowiki>https://opensea.io</nowiki> in your browser when you sign messages.
"[M]any details of the attack remain unclear — particularly the method attackers used to get targets to sign the half-empty contract. Writing on Twitter shortly before 3AM ET, OpenSea CEO Devin Finzer said the attacks had not originated from OpenSea’s website, its various listing systems, or any emails from the company. The rapid pace of the attack — hundreds of transactions in a matter of hours — suggests some common vector of attack, but so far no link has been discovered."


"We're reaching out to the folks who reported this to investigate. Please continue to be vigilant when prompted with a wallet signature."
If you are an affected user, please DM @opensea_support so that we can thoroughly investigate — we’d love your help.


== Prevention Policies ==
For more technical context, this thread is consistent with our current internal understanding.
Which policies could have prevented this event from happening?


== References ==
If you are concerned and want to protect yourself, you can un-approve access to your NFT collection [via EtherScan's token approval checker].
<references><ref name="slowmisthacked-2069">[https://hacked.slowmist.io/en/ SlowMist Hacked - SlowMist Zone] (Jun 25, 2021)</ref>


<ref name="opensea-6981">[https://opensea.io/ https://opensea.io/] (Mar 9, 2022)</ref>
Importantly, rumors that this was a $200 million hack are false. The attacker has $1.7 million of ETH in his wallet from selling some of the stolen NFTs.</blockquote>


<ref name="youtube-6982">[https://www.youtube.com/watch?v=gfGuPd1CELo Meet OpenSea | The NFT marketplace with everything for everyone - YouTube] (Mar 9, 2022)</ref>
=== Tweet From OpenSea ===
<ref name="openseatwitterannouncement-10519" /><blockquote>Our leadership, engineering, and security teams are communicating with affected users to gather details. We continue to believe that this is a phishing attack that originated outside of <nowiki>http://opensea.io</nowiki>.


<ref name="openseadocs-6983">[https://docs.opensea.io/docs https://docs.opensea.io/docs] (Mar 9, 2022)</ref>
We’ve seen a lot of uncertainty from the community, so we want to be clear on three points:


<ref name="openseadocs-6984">[https://docs.opensea.io/docs/frequently-asked-questions https://docs.opensea.io/docs/frequently-asked-questions] (Mar 9, 2022)</ref>
1. This appears to be an isolated incident impacting a small number of people.


<ref name="opensea-6985">[https://opensea.io/about https://opensea.io/about] (Mar 9, 2022)</ref>
2. The attack does not appear to be email-based.


<ref name="theverge-6986">[https://www.theverge.com/2022/2/20/22943228/opensea-phishing-hack-smart-contract-bug-stolen-nft $1.7 million in NFTs stolen in apparent phishing attack on OpenSea users - The Verge] (Mar 9, 2022)</ref>
3. The migration tool is safe to use. For more information about this tool, read our help center article: <nowiki>https://support.opensea.io/hc/en-us/articles/4433163594643-Smart-Contract-Upgrade-How-to-Migrate-Your-Item-Listings</nowiki>


<ref name="googledoc-6987">[https://docs.google.com/spreadsheets/d/1XQNIXuAl2E1XO_cP8pm_vbzskI_Pka4E5sizfcrLITM/edit Opensea Phishing Incident Stolen NFT List - Google Sheets] (Mar 9, 2022)</ref>
If you have specific information that could be useful, please DM @opensea_support.</blockquote>


<ref name="youtube-6988">[https://www.youtube.com/watch?v=H3TABd_nBJU NFTs and the $13B marketplace, explained - YouTube] (Mar 10, 2022)</ref>


<ref name="web3isgoinggreat-6989">[https://web3isgoinggreat.com/?id=2022-02-19-1 Indian authorities arrest a group accused of $5 million cryptocurrency scam – Web3 Is Going Just Great] (Mar 10, 2022)</ref>


<ref name="jonhqtwitter-6990">[https://twitter.com/Jon_HQ/status/1495194178355011586 @Jon_HQ Twitter] (Mar 10, 2022)</ref>
"OpenSea was in the process of updating its contract system when the attack took place, but OpenSea has denied that the attack originated with the new contracts. The relatively small number of targets makes such a vulnerability unlikely, since any flaw in the broader platform would likely be exploited on a far greater scale."


<ref name="ajfromdiscordtwitter-6991">[https://twitter.com/AJFromDiscord/status/1495185887625367556 @AJFromDiscord Twitter] (Mar 10, 2022)</ref>


<ref name="mikeburgersburgtwitter-6992">[https://twitter.com/MikeBurgersburg/status/1495204914460598289 @MikeBurgersburg Twitter] (Mar 10, 2022)</ref>


<ref name="etherscan-6993">[https://etherscan.io/address/0x3e0defb880cd8e163bad68abe66437f99a7a8a74 https://etherscan.io/address/0x3e0defb880cd8e163bad68abe66437f99a7a8a74] (Mar 10, 2022)</ref>
“I checked every transaction,” said [one] user, who goes by Neso. “They all have valid signatures from the people who lost NFTs so anyone claiming they didn’t get phished but lost NFTs is sadly wrong.”
 
"OpenSea co-founder and CEO Devin Finzer confirmed the phishing attack in a tweet." "Afterwards, Devin Finzer confirmed that this was a “phishing attack”, but it has not been possible to verify where the “phishing” occurred. The only thing that can be confirmed after investigation is that the phishing attack did not come from the inside of the OpenSea website."


<ref name="openseatwitter-6994">[https://twitter.com/opensea/status/1495625884514066433 @opensea Twitter] (Mar 10, 2022)</ref>
On official statement was released by OpenSea at the time.


<ref name="dfinzertwitter-6995">[https://twitter.com/dfinzer/status/1495245313304530952 @dfinzer Twitter] (Mar 10, 2022)</ref>
"Our leadership, engineering, and security teams are communicating with affected users to gather details. We continue to believe that this is a phishing attack that originated outside of http://opensea.io."


<ref name="nesotualtwitter-6996">[https://twitter.com/Nesotual/status/1495223135800643592 @Nesotual Twitter] (Mar 10, 2022)</ref>
=== Community Reactions ===
There were several reactions on Twitter<ref name=":1" />.<blockquote>Are you guys doing anything to help make this right with customers like me that lost our NFTs???</blockquote>


<ref name="theverge-6997">[https://www.theverge.com/2022/2/2/22914081/open-sea-nft-marketplace-web3-fundraising-finzer-a16z How OpenSea took over the NFT trade - The Verge] (Mar 10, 2022)</ref>
== Ultimate Outcome ==
Most of the unsold NFTs were returned to victims. In addition, one victim received an "inexplicabl[e]" payment of 50 ETH ($130,000) from the attacker.


<ref name="dune-6998">[https://dune.xyz/queries/37672/74639 Dune Analytics] (Mar 10, 2022)</ref>
1,115 ETH, worth an estimated $2.9m, were transferred from the attacker to a cryptocurrency tumbler.


<ref name="dfinzertwitter-6999">[https://twitter.com/dfinzer/status/1495302786811981825 @dfinzer Twitter] (Mar 10, 2022)</ref>
The attacker's wallet address has been flagged on Etherscan<ref name="attackersaddress-6993" />.


<ref name="coindesk-7000">[https://www.coindesk.com/business/2022/02/21/opensea-says-phishing-attack-impacted-17-users/ OpenSea Says Phishing Attack Impacted 17 Users] (Mar 10, 2022)</ref>
== Total Amount Recovered ==
Most of the unsold NFTs were returned to victims, with some returns starting almost immediately<ref name="dfinzertwitter-6995" />. In addition, one victim received an "inexplicabl[e]" payment of 50 ETH ($130,000) from the attacker.


<ref name="zdnet-7001">[https://www.zdnet.com/article/opensea-scam-artists-swindle-nfts-worth-millions-in-phishing-attack/ Scam artists swindle NFTs worth 'millions' in OpenSea phishing attack | ZDNet] (Mar 10, 2022)</ref>
"Hackers return most of the unsold NFTs to victims." "Bizarrely, the hacker returned some of the NFTs to their original owners, and one victim inexplicably received 50 ETH ($130,000) from the attacker as well as some of his stolen NFTs back. The attacker later transferred 1,115 ETH obtained from the attack to a cryptocurrency tumbler, worth around $2.9 million."


<ref name="cointelegraph-7002">[https://cointelegraph.com/news/opensea-phishing-scandal-reveals-a-security-need-across-the-nft-landscape OpenSea phishing scandal reveals a security need across the NFT landscape] (Mar 10, 2022)</ref>
The total amount recovered has been estimated at $1,700,000 USD.


<ref name="cnet-7003">[https://www.cnet.com/personal-finance/crypto/opensea-says-at-least-1-7m-in-nfts-stolen-in-phishing-attack/ OpenSea Says at Least $1.7M in NFTs Stolen in Phishing Attack - CNET] (Mar 10, 2022)</ref>
== Ongoing Developments ==
"[M]any details of the attack remain unclear — particularly the method attackers used to get targets to sign the half-empty contract. Writing on Twitter shortly before 3AM ET, OpenSea CEO Devin Finzer said the attacks had not originated from OpenSea’s website, its various listing systems, or any emails from the company. The rapid pace of the attack — hundreds of transactions in a matter of hours — suggests some common vector of attack, but so far no link has been discovered."


<ref name="threatpost-7004">[https://threatpost.com/nft-investors-lose-1-7m-in-opensea-phishing-attack/178558/ NFT Investors Lose $1.7M in OpenSea Phishing Attack | Threatpost] (Mar 10, 2022)</ref>
"We're reaching out to the folks who reported this to investigate. Please continue to be vigilant when prompted with a wallet signature."
==Individual Prevention Policies ==
This situation appears to be related to targeted phishing attacks against OpenSea users. Users in the DeFi space need to exercise a high degree of caution in all communications to ensure that they are coming from the claimed sender. Users should ensure they are aware of which actions which could place their funds at risk. Signing of any smart contract from an unaudited source is not a good idea, particularly a partially formed smart contract. Storing most NFTs offline can prevent them from being lost in the event of a breach.


<ref name="openseatwitter-7005">[https://twitter.com/opensea/status/1495211277097996290 @opensea Twitter] (Mar 10, 2022)</ref>
{{Prevention:Individuals:Protect Personal Information}}


<ref name="openseatwitter-7006">[https://twitter.com/opensea/status/1495996847546335237 @opensea Twitter] (Mar 10, 2022)</ref>
{{Prevention:Individuals:Double Check Transactions}}


<ref name="openseatwitter-7007">[https://twitter.com/opensea/status/1497289446529536001 @opensea Twitter] (Mar 10, 2022)</ref>
{{Prevention:Individuals:Safe Smart Contract Usage}}


<ref name="coinyuppie-7234">[https://coinyuppie.com/phishing-attack-from-opensea-to-analyze-blockchain-hacking-methods/ Phishing attack from OpenSea to analyze blockchain hacking methods - CoinYuppie: Bitcoin, Ethereum, Metaverse, NFT, DAO, DeFi, Dogecoin, Crypto News] (Mar 16, 2022)</ref>
{{Prevention:Individuals:End}}
== Platform Prevention Policies==
The primary defense against phishing is better education for users. Ensure that users have an understanding of the risks and strategies to protect themselves.


<ref name="cpomagazine-7315">[https://www.cpomagazine.com/cyber-security/phishing-attack-on-nft-marketplace-opensea-results-in-thefts-from-17-accounts-victims-tricked-into-signing-malicious-payloads/ https://www.cpomagazine.com/cyber-security/phishing-attack-on-nft-marketplace-opensea-results-in-thefts-from-17-accounts-victims-tricked-into-signing-malicious-payloads/] (Mar 20, 2022)</ref>
{{Prevention:Platforms:Cryptocurrency Safety Quiz}}


<ref name="etherscan-8646">[https://etherscan.io/tx/0xdfa95e85496c489e7f3b2dbe570ed2b261c3390443c8f6053eb6d76acd30c5e9  https://etherscan.io/tx/0xdfa95e85496c489e7f3b2dbe570ed2b261c3390443c8f6053eb6d76acd30c5e9] (Jul 21, 2022)</ref>
In the event that a user falls for a phishing attack, an industry insurance fund could assist.


<ref name="dashboard-8647">[https://dashboard.tenderly.co/tx/mainnet/0xdfa95e85496c489e7f3b2dbe570ed2b261c3390443c8f6053eb6d76acd30c5e9/debugger?trace=0.1 Tenderly Dashboard] (Jul 21, 2022)</ref>
{{Prevention:Platforms:Establish Industry Insurance Fund}}


<ref name="talbeerysectwitter-8648">[https://twitter.com/TalBeerySec/status/1495331621351968769 @TalBeerySec Twitter] (Jul 21, 2022)</ref>
{{Prevention:Platforms:End}}
==Regulatory Prevention Policies==
The primary defense against phishing is better education for users. Ensure that users have an understanding of the risks and strategies to protect themselves.


<ref name="gadgets360-10518">[https://www.gadgets360.com/cryptocurrency/news/opensea-nft-phishing-attack-usd-1-7-million-ether-missing-2779865 OpenSea Loses NFTs Worth $1.7 Million in Phishing Attack, Investigation Underway | Technology News] (Feb 6, 2023)</ref>
{{Prevention:Regulators:Cryptocurrency Education Mandate}}


<ref name="openseatwitter-10519">[https://twitter.com/opensea/status/1495473882806947841 @opensea Twitter] (Feb 6, 2023)</ref>
In the event that a user falls for a phishing attack, an industry insurance fund could assist.


<ref name="nadavahollandertwitter-10520">[https://twitter.com/NadavAHollander/status/1495509514199650313 @NadavAHollander Twitter] (Feb 6, 2023)</ref>
{{Prevention:Regulators:Establish Industry Insurance Fund}}


<ref name="thinksproutinfotech-8854">[https://thinksproutinfotech.com/news/phishing-attack-strikes-moonbirds-nft-project-details-here/ Phishing Attack Strikes ‘Moonbirds’ NFT Project, Details Here - Techsprout News] (Aug 23, 2022)</ref></references>
{{Prevention:Regulators:End}}
== References ==
<references>
<ref name="slowmist-2069">[https://hacked.slowmist.io/en/ SlowMist Hacked - SlowMist Zone] (Jun 25, 2021)</ref>
<ref name="opensea-6981">[https://opensea.io/ OpenSea Homepage] (Mar 9, 2022)</ref>
<ref name="openseayoutube-6982">[https://www.youtube.com/watch?v=gfGuPd1CELo OpenSea - "Meet OpenSea | The NFT marketplace with everything for everyone" - YouTube] (Mar 9, 2022)</ref>
<ref name="openseadocs-6983">[https://docs.opensea.io/docs OpenSea Documentation] (Mar 9, 2022)</ref>
<ref name="openseafaq-6984">[https://docs.opensea.io/docs/frequently-asked-questions Frequently Asked Questions - OpenSea] (Mar 9, 2022)</ref>
<ref name="openseaabout-6985">[https://opensea.io/about About - OpenSea] (Mar 9, 2022)</ref>
<ref name="theverge-6986">[https://www.theverge.com/2022/2/20/22943228/opensea-phishing-hack-smart-contract-bug-stolen-nft $1.7 million in NFTs stolen in apparent phishing attack on OpenSea users - The Verge] (Mar 9, 2022)</ref>
<ref name="peckshieldlist-6987">[https://docs.google.com/spreadsheets/d/1XQNIXuAl2E1XO_cP8pm_vbzskI_Pka4E5sizfcrLITM/edit Opensea Phishing Incident Stolen NFT List - Google Sheets] (Mar 9, 2022)</ref>
<ref name="youtubenfts-6988">[https://www.youtube.com/watch?v=H3TABd_nBJU The Verge - NFTs and the $13B marketplace, explained - YouTube] (Mar 10, 2022)</ref>
<ref name="web3isgoinggreat-6989">[https://web3isgoinggreat.com/?id=seventeen-opensea-users-hit-by-phishing-attack Seventeen OpenSea users have their NFTs stolen and flipped for a total of $2.9 million by a phishing scammer – Web3 Is Going Just Great] (Mar 10, 2022)</ref>
<ref name="jonhqtwitter-6990">[https://web.archive.org/web/20220220003416/https://twitter.com/Jon_HQ/status/1495194178355011586 <nowiki>Jon_HQ - "I am very unsure how this is working or what is being exploited but it seems that OpenSea's new contract is ab[so]lutely rugged." - Twitter</nowiki>] (Mar 10, 2022)</ref>
<ref name="ajfromdiscordtwitter-6991">[https://twitter.com/AJFromDiscord/status/1495185887625367556 AJFromDiscord - "ALL OF OUR STOLEN NFT'S WERE ONES WE MANUALLY MIGRATED ON OPENSEA" - Twitter] (Mar 10, 2022)</ref>
<ref name="mikeburgersburgtwitter-6992">[https://twitter.com/MikeBurgersburg/status/1495204914460598289 MikeBurgersburg - "578 Ethereum (~$1.7 million) transferred from dozens of wallets through opensea to a hacker." -  Twitter] (Mar 10, 2022)</ref>
<ref name="attackersaddress-6993">[https://etherscan.io/address/0x3e0defb880cd8e163bad68abe66437f99a7a8a74 Attacker's Wallet Address - Etherscan] (Mar 10, 2022)</ref>
<ref name="openseatwitter-6994">[https://twitter.com/opensea/status/1495625884514066433 opensea - "We’ve narrowed down the list of impacted individuals to 17, rather than the previously mentioned 32." - Twitter] (Mar 10, 2022)</ref>
<ref name="dfinzertwitter-6995">[https://twitter.com/dfinzer/status/1495245313304530952 Devin Finzer - "For more technical context, this thread is consistent with our current internal understanding." - Twitter] (Mar 10, 2022)</ref>
<ref name="nesotualtwitter-6996">[https://web.archive.org/web/20220220144829/https://twitter.com/Nesotual/status/1495223117450551300 Nesotual - "Seen confusion about the OS thing so. Attacker had people sign half of a valid wyvern order, the order was basically empty except the target (attacker contract) and calldata, attacker signs other half of order." - Twitter Archive February 20th, 2022 7:48:29 AM MST] (Mar 10, 2022)</ref>
<ref name="theverge2-6997">[https://www.theverge.com/2022/2/2/22914081/open-sea-nft-marketplace-web3-fundraising-finzer-a16z How OpenSea took over the NFT trade - The Verge] (Mar 10, 2022)</ref>
<ref name="dunexyz-6998">[https://dune.xyz/queries/37672/74639 Dune Analytics] (Mar 10, 2022)</ref>
<ref name="dfinzertwitter2-6999">[https://twitter.com/dfinzer/status/1495302786811981825 @dfinzer Twitter] (Mar 10, 2022)</ref>
<ref name="coindesk-7000">[https://www.coindesk.com/business/2022/02/21/opensea-says-phishing-attack-impacted-17-users/ OpenSea Says Phishing Attack Impacted 17 Users] (Mar 10, 2022)</ref>
<ref name="zdnet-7001">[https://www.zdnet.com/article/opensea-scam-artists-swindle-nfts-worth-millions-in-phishing-attack/ Scam artists swindle NFTs worth 'millions' in OpenSea phishing attack | ZDNet] (Mar 10, 2022)</ref>
<ref name="cointelegraph-7002">[https://cointelegraph.com/news/opensea-phishing-scandal-reveals-a-security-need-across-the-nft-landscape OpenSea phishing scandal reveals a security need across the NFT landscape] (Mar 10, 2022)</ref>
<ref name="cnet-7003">[https://www.cnet.com/personal-finance/crypto/opensea-says-at-least-1-7m-in-nfts-stolen-in-phishing-attack/ OpenSea Says at Least $1.7M in NFTs Stolen in Phishing Attack - CNET] (Mar 10, 2022)</ref>
<ref name="threatpost-7004">[https://threatpost.com/nft-investors-lose-1-7m-in-opensea-phishing-attack/178558/ NFT Investors Lose $1.7M in OpenSea Phishing Attack | Threatpost] (Mar 10, 2022)</ref>
<ref name="openseatwitter2-7005">[https://twitter.com/opensea/status/1495211277097996290 @opensea Twitter] (Mar 10, 2022)</ref>
<ref name="openseatwitter3-7006">[https://twitter.com/opensea/status/1495996847546335237 @opensea Twitter] (Mar 10, 2022)</ref>
<ref name="openseatwitter4-7007">[https://twitter.com/opensea/status/1497289446529536001 @opensea Twitter] (Mar 10, 2022)</ref>
<ref name="coinyuppie-7234">[https://coinyuppie.com/phishing-attack-from-opensea-to-analyze-blockchain-hacking-methods/ Phishing attack from OpenSea to analyze blockchain hacking methods - CoinYuppie: Bitcoin, Ethereum, Metaverse, NFT, DAO, DeFi, Dogecoin, Crypto News] (Mar 16, 2022)</ref>
<ref name="cpomagazine-7315">https://www.cpomagazine.com/cyber-security/phishing-attack-on-nft-marketplace-opensea-results-in-thefts-from-17-accounts-victims-tricked-into-signing-malicious-payloads/ (Mar 20, 2022)</ref>
<ref name="nfttransferaway-8646">https://etherscan.io/tx/0xdfa95e85496c489e7f3b2dbe570ed2b261c3390443c8f6053eb6d76acd30c5e9 (Jul 21, 2022)</ref>
<ref name="tenderlytracer-8647">[https://dashboard.tenderly.co/tx/mainnet/0xdfa95e85496c489e7f3b2dbe570ed2b261c3390443c8f6053eb6d76acd30c5e9/debugger?trace=0.1 Tenderly Dashboard] (Jul 21, 2022)</ref>
<ref name="talbeerysectwitter-8648">[https://twitter.com/TalBeerySec/status/1495331621351968769 @TalBeerySec Twitter] (Jul 21, 2022)</ref>
<ref name="gadgets360-10518">[https://www.gadgets360.com/cryptocurrency/news/opensea-nft-phishing-attack-usd-1-7-million-ether-missing-2779865 OpenSea Loses NFTs Worth $1.7 Million in Phishing Attack, Investigation Underway | Technology News] (Feb 6, 2023)</ref>
<ref name="openseatwitterannouncement-10519">[https://twitter.com/opensea/status/1495473882806947841 OpenSea - "Our leadership, engineering, and security teams are communicating with affected users to gather details. We continue to believe that this is a phishing attack that originated outside of http://opensea.io." - Twitter] (Feb 6, 2023)</ref>
<ref name="nadavahollandertwitter-10520">[https://twitter.com/NadavAHollander/status/1495509514199650313 Nadav Hollander - "None of the malicious orders were executed against the new (Wyvern 2.3) contract, indicating that they were signed before the migration and are unlikely to be related to OpenSea’s migration flow." - Twitter] (Feb 6, 2023)</ref>
<ref name="thinksproutinfotech-8854">[https://thinksproutinfotech.com/news/phishing-attack-strikes-moonbirds-nft-project-details-here/ Phishing Attack Strikes ‘Moonbirds’ NFT Project, Details Here - Techsprout News] (Aug 23, 2022)</ref>
</references>

Latest revision as of 12:41, 19 December 2023

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

OpenSea Homepage/Logo

Several OpenSea users reported that NFTs had disappeared from their accounts. A total of 254 different NFTs were taken from 17 separate accounts, including valuable Decentraland and Bored Ape Yacht Club NFTs. OpenSea posted an official tweet to community that they are investigating the situation and believe that it's a phishing attack. It is unclear if any of the funds have been recovered.

[1][2][3][4][5][6][7][8][9][10][11][12][13][14][15][16][17][18]

About OpenSea

"The world’s first and largest digital marketplace for crypto collectibles and non-fungible tokens (NFTs). Buy, sell, and discover exclusive digital items." "Discover, collect, and sell extraordinary NFTs. OpenSea is the world's first and largest NFT marketplace."

"As the first and largest marketplace for Non-Fungible Tokens and Semi-Fungible Tokens, OpenSea provides a first-in-class developer platform consisting of an API, SDK, and developer tutorials. Feel free to browse around and get acclimated with developing smart contracts and interacting with NFT data."

"Fascinated by the [CryptoKitties] movement that was forming, Devin Finzer and Alex Atallah joined early adopter communities in Discord and started talking to users. With the OpenSea beta launch in December 2017, the first open marketplace for any non-fungible token on the Ethereum blockchain was born."

"Valued at $13 billion in a recent funding round, OpenSea has become one of the most valuable companies of the NFT boom, providing a simple interface for users to list, browse, and bid on tokens without interacting directly with the blockchain."

Homepage:[19]

About:[20]

Documentation:[21]

Frequently Asked Questions:[22]

YouTube Promotion:[23]

Explanation of NFTs:[24]

The Reality

While self-custody is incredibly powerful, great power requires great responsibility. Users need to educate themselves on how to properly secure their funds. The cleverness of phishing attackers is not to be underestimated.

What Happened

On February 19th, 2022, a handful of OpenSea users reported that valuable NFTs had been stolen from them. Many others feared that the same fate could happen to them - and it could, if they fell for the same phishing attack. This was one of the most successful phishing attacks against OpenSea users with 254 NFTs taken from 17 different users, including valuable Decentraland and Bored Ape Yacht Club NFTs. The bulk of the attacks took place between 5PM and 8PM Eastern Time.

Key Event Timeline - OpenSea Phishing Attack
Date Event Description
February 19th, 2022 4:10:37 PM MST AJFromDiscord Malicious Transfer AJFromDiscord's 8 NFTs are taken[25], which include Fighter #3635, Fighter #3634, Hero #3097, Azuki #7916, Azuki #746, PXQuest Adventurer #4331, TheCurrency #1757, and TheCurrency #2634. All NFTs end up at an account which has been nicknamed Fake_Phishing5169.
February 19th, 2022 4:57:00 PM MST AJFromDiscord Tweet Twitter user AJFromDiscord (Alabaster Jefferson) posts that he's connected with others who also got hacked and links to a transaction which was executed[26]. (TBD more details.)
February 19th, 2022 5:30:00 PM MST Jon_HQ Twitter Post Twitter user Jon_HQ makes a post which is widely cited, with the first report of a malicious transaction stealing funds[27]. (TBD more detail).
February 19th, 2022 6:13:00 PM MST MikeBurgersburg Analysis Tweet Twitter user MikeBurgersburg posts a more detailed breakdown of the transaction flow and what he believes happened[28]. (TBD more details).
February 19th, 2022 7:25:50 PM MST Neso Technical Analysis Tweet Twitter user Nesotual shares a technical analysis of the exploit in a series of tweets[29]. Nesotual clarified the OpenSea (OS) incident, explaining that the attacker orchestrated a phishing attack by having users sign half of a valid Wyvern order. The order was essentially empty, except for the target (attacker contract) and calldata. The attacker then signed the other half of the order, calling their own contract with calldata, including the valid order, address, and transfer calldata for all NFTs approved on the Wyvern (OpenSea) contract. By exploiting the flexibility of Wyvern contracts, the attacker tricked users into approving unintended transactions, leading to the loss of NFTs. Nesotual emphasized that all affected transactions had valid signatures, debunking claims of users not falling victim to phishing but losing NFTs.
February 19th, 2022 7:33:00 PM MST Web3isGoingGreat The incident makes the news in Web3isGoingGreat[30][31].
February 19th, 2022 8:53:00 PM MST Devin Finzer Tweet In a tweet, Devin Finzer, co-founder of OpenSea, addresses concerns about a potential security breach. According to Finzer, the incident seems to be a phishing attack, not directly connected to the OpenSea website. Approximately 32 users fell victim to the attack, signing a malicious payload, resulting in the theft of some NFTs. The attack appears inactive for the past two hours, and some stolen NFTs have been returned. OpenSea is conducting an investigation and urges affected users to reach out for assistance. Finzer emphasized the importance of verifying interaction with the official OpenSea website and dispelled rumors of a $200 million hack, clarifying that the attacker holds $1.7 million worth of ETH from selling stolen NFTs[32].
February 20th, 2022 7:37:00 AM MST The Verge Article An article is published in The Verge, indicating that $1.7m had been lost in the attack[33]. (TBD expand with more detail.)
February 20th, 2022 12:02:00 PM OpenSea Tweet OpenSea posts and official tweet to community that they are investigating the situation and believe that it's a phishing attack[18]. They include that it's an "isolated incident impacting a small number of people", "does not appear to be email-based", and that "[t]he migration tool is safe to use"[18].
February 20th, 2022 2:23:00 PM MST Nadav Hollander Technical Analysis Twitter user Nadav Hollander investigates and reports that "[n]one of the malicious orders were executed against the new (Wyvern 2.3) contract, indicating that they were signed before the migration and are unlikely to be related to OpenSea’s migration flow."[34]
February 20th, 2022 10:06:00 PM MST Narrowed To 17 Victimes OpenSea posts that they've narrowed down the list of affected users to just 17[35].
May 26th, 2022 3:02:55 AM MDT Techsprout News Article The attack is mentioned briefly at the end of a Techsprout News article[36].

Technical Details

The Wyvern smart contract which governs OpenSea swaps is highly flexible, and can be used for more complex order types than just transferring a single NFT. The attacker created a malicious smart contract, which authorized the attacker to have access to all the NFTs in any wallet which approved the contract. Through a phishing campaign, they then tricked 17 users into authorizing that smart contract. This allowed them to acquire 254 different NFTs, many of which were liquidated.

Creation of Smart Contract

"The Zhifan security team analyzed and found that [a] hacker address 0x3E0…8A74 created a smart contract 0xa2…45bD at 9:31:12 (UTC) on January 22, one month ago."

"The attack appears to have exploited a flexibility in the Wyvern Protocol, the open-source standard underlying most NFT smart contracts, including those made on OpenSea. One explanation (linked by CEO Devin Finzer on Twitter) described the attack in two parts: first, targets signed a partial contract, with a general authorization and large portions left blank. With the signature in place, attackers completed the contract with a call to their own contract, which transferred ownership of the NFTs without payment. In essence, targets of the attack had signed a blank check — and once it was signed, attackers filled in the rest of the check to take their holdings."

Phishing Campaign Launched

"[M]any details of the attack remain unclear — particularly the method attackers used to get targets to sign the half-empty contract. Writing on Twitter shortly before 3AM ET, OpenSea CEO Devin Finzer said the attacks had not originated from OpenSea’s website, its various listing systems, or any emails from the company. The rapid pace of the attack — hundreds of transactions in a matter of hours — suggests some common vector of attack, but so far no link has been discovered."

The "attacker had successfully phished 17 OpenSea users into signing a malicious contract, which allowed the attacker to take the NFTs and then flip them."

Twitter user @NadavAHollander explains the exploit further:

"None of the malicious orders were executed against the new (Wyvern 2.3) contract, indicating that they were signed before the migration and are unlikely to be related to OpenSea’s migration flow."

Unclear: [37]

Neso Technical Analysis

Twitter user Nesotual was one of the first to publish a technical analysis of the exploit[29]. Their explanation was shared by OpenSea co-founder Devin Finzer in his initial tweet[32].

Seen confusion about the OS thing so.

Attacker had people sign half of a valid wyvern order, the order was basically empty except the target (attacker contract) and calldata, attacker signs other half of order.

Attacker calls their own contract with calldata including the valid order AND address + transfer calldata for all the NFTs the target has approved on the wyvern (opensea) contract.

The nft address + transfer calldata is saved then the signed order is sent to the wyvern contract atomicmatch, it checks the orders is valid (it is) and signatures are correct for the maker and taker (they are)

Now wyvern is past order validation, it calls the proxy contract your OS approvals are on, then that delegatecalls the target contract (attacker) with the calldata in the order (the target and calldata in most orders is the NFT you're buying/selling and the transferFrom call)

in this case it goes back to a different function in the attacker contract that then loops the previously saved transfer calldata + token addresses in the context of the proxy contract that has the user approvals.

All nfts gone GG. I checked every tx, they all have valid signatures from the people who lost NFTs so anyone claiming they didn't get phished but lost NFTs is sadly wrong.

The wyvern contracts are extremely flexible, opensea validates orders on their frontend/api to ensure what you're signing will function as expected, but the same contracts can still be used by others with more complex orders like this that if you sign can take everything approved

Nadav Hollander Technical Analysis

Nadav Hollander published a technical analysis of the phishing attack[34].

1) Sharing a technical run-down of the phishing attacks targeting @OpenSea users, including some web3 technical education.

2) After reviewing the malicious orders, the following data points stand out:

- All of the malicious orders contain valid signatures from the affected users, indicating that they did sign an order somewhere, at some point in time. However, none of these orders were broadcasted to OpenSea at the time of signing.

- None of the malicious orders were executed against the new (Wyvern 2.3) contract, indicating that they were signed before the migration and are unlikely to be related to OpenSea’s migration flow.

- 32 users had NFTs stolen over a relatively short time period. This is extremely unfortunate, but suggests a targeted attack as opposed to a systemic issue.

3) This information, coupled with our discussions with impacted users and investigation by security experts, suggests a phishing operation that was executed ahead of the deprecation of the 2.2 contract given the impending invalidation of these collected malicious orders.

4) Prior to the current phishing scam, part of why we elected to implement EIP-712 on the new contract is that EIP-712’s typed data feature makes it much more difficult for bad actors to trick someone into signing an order without realizing it.

5) For example, if you are signing a message to join a whitelist, a raffle, or a token-gated discord group and you're presented with a typed data payload referencing Wyvern (the protocol used by OpenSea), it's much more likely to alert you to something unusual going on.

6) Education on not sharing seed phrases or submitting unknown transactions has become more widespread in our space. However, signing off-chain messages requires equal consideration.

7) We as a community must move to standardizing off-chain signatures using EIP-712 typed data or other agreed-upon standards like EIP-4361 (the "Sign in with Ethereum" method).

8) On this point, you'll notice that all new orders signed on OpenSea (including migrated orders) use the new EIP-712 format — a change of any kind is understandably scary, but this change actually makes signing much safer as you can better see what you're signing.

9) Big shoutout to @nesotual, @dguido, @quantstamp, and many others for providing detailed information on the nature of the attack to the community.

10) Additionally, even though it appears the attack was made from outside OpenSea, we are actively helping affected users and discussing ways to provide them additional assistance.

Total Amount Lost

There were reported losses of 254 NFTs across 17 different user accounts, including highly valuable Decentraland and Bored Ape Yacht Club NFTs.

List of NFTs Taken

An Incomplete List Of NFTs Taken
NFT Time Taken Victim New Account Approximate Value
Fighter #3635 February 19th, 2022 4:10:37 PM MST AJFromDiscord Fake_Phishing5169
Fighter #3634 February 19th, 2022 4:10:37 PM MST AJFromDiscord Fake_Phishing5169
Hero #3097 February 19th, 2022 4:10:37 PM MST AJFromDiscord Fake_Phishing5169
Azuki #7916 February 19th, 2022 4:10:37 PM MST AJFromDiscord Fake_Phishing5169
Azuki #746 February 19th, 2022 4:10:37 PM MST AJFromDiscord Fake_Phishing5169
PXQuest Adventurer #4331 February 19th, 2022 4:10:37 PM MST AJFromDiscord Fake_Phishing5169
TheCurrency #1757 February 19th, 2022 4:10:37 PM MST AJFromDiscord Fake_Phishing5169
TheCurrency #2634 February 19th, 2022 4:10:37 PM MST AJFromDiscord Fake_Phishing5169
Shalerhouser? TBD - Check for losses from Shalerhouser[38]

Loss Estimates

Web3isGoingGreat[31] and Devin Finzer[32] originally estimated the loss at $1.7m, however later revised the estimate to $2.9m[30].

"Molly White, who runs the blog Web3 is Going Great, estimated the value of the stolen tokens at more than $1.7 million." "OpenSea initially said 32 users had been affected, but later revised that number to 17, saying 15 of the initial count had interacted with the attacker but not lost tokens as a result."

SlowMist estimated the loss amount at $3.4m[39].

A list of stolen NFTs has been published on a Google Sheet[40], however the list has subsequently been removed[41].

The total amount lost has been estimated at $3,400,000 USD.

Immediate Reactions

"Panic erupted on February 19 as a few users saw their wallets emptied of valuable NFTs without knowing why, and many others feared the same could happen to them." "[A]ttackers stole hundreds of NFTs from OpenSea users, causing a late-night panic among the site’s broad user base. A spreadsheet compiled by the blockchain security service PeckShield counted 254 tokens stolen over the course of the attack, including tokens from Decentraland and Bored Ape Yacht Club, with the bulk of the attacks taking place between 5PM and 8PM ET."


"A number of users posted a warning on Twitter [on the] morning [of February 19th] that the new migration contract launched by OpenSea yesterday was suspected of having a bug, and the attacker used the bug to steal a large amount of NFT and sell more than 0 ~$3.4 million) NFTs, most of which have been deposited in TornadoCash." "Early explanations blamed a new contract that OpenSea had rolled out, or an airdrop from a new NFT marketplace called X2Y2. People urged NFT owners to revoke permissions for both the OpenSea contract and for X2Y2 until more was known, although one of the most popular websites helping people do so went down shortly after from the high traffic."

"An hour and a half after users began to report missing NFTs, OpenSea finally acknowledged the issue. They tweeted that they were "actively investigating rumors of an exploit associated with OpenSea related smart contracts", and wrote that they believed it was a phishing attack coming from outside of OpenSea, rather than an issue with their contract."

Devin Finzer Initial Tweet

In an initial tweet, Devin Finzer, co-founder of OpenSea, addressed some concerns. According to Finzer, the incident seems to be a phishing attack, not directly connected to the OpenSea website. Approximately 32 users fell victim to the attack, signing a malicious payload, resulting in the theft of some NFTs. The attack appears inactive for the past two hours, and some stolen NFTs have been returned. OpenSea is conducting an investigation and urges affected users to reach out for assistance. Finzer emphasized the importance of verifying interaction with the official OpenSea website and dispelled rumors of a $200 million hack, clarifying that the attacker holds $1.7 million worth of ETH from selling stolen NFTs[32].

I know you’re all worried. We’re running an all hands on deck investigation, but I want to take a minute to share the facts as I see them:

As far as we can tell, this is a phishing attack. We don’t believe it’s connected to the OpenSea website. It appears 32 users thus far have signed a malicious payload from an attacker, and some of their NFTs were stolen.

The attack doesn’t appear to be active at this point — we haven’t seen any malicious activity from the attacker’s account in 2 hours. Some of the NFTs have been returned.

We are not aware of any recent phishing emails that have been sent to users, but at this time we do not know which website was tricking users into maliciously signing messages.

Always double check that you are interacting with https://opensea.io in your browser when you sign messages.

If you are an affected user, please DM @opensea_support so that we can thoroughly investigate — we’d love your help.

For more technical context, this thread is consistent with our current internal understanding.

If you are concerned and want to protect yourself, you can un-approve access to your NFT collection [via EtherScan's token approval checker].

Importantly, rumors that this was a $200 million hack are false. The attacker has $1.7 million of ETH in his wallet from selling some of the stolen NFTs.

Tweet From OpenSea

[18]

Our leadership, engineering, and security teams are communicating with affected users to gather details. We continue to believe that this is a phishing attack that originated outside of http://opensea.io.

We’ve seen a lot of uncertainty from the community, so we want to be clear on three points:

1. This appears to be an isolated incident impacting a small number of people.

2. The attack does not appear to be email-based.

3. The migration tool is safe to use. For more information about this tool, read our help center article: https://support.opensea.io/hc/en-us/articles/4433163594643-Smart-Contract-Upgrade-How-to-Migrate-Your-Item-Listings

If you have specific information that could be useful, please DM @opensea_support.


"OpenSea was in the process of updating its contract system when the attack took place, but OpenSea has denied that the attack originated with the new contracts. The relatively small number of targets makes such a vulnerability unlikely, since any flaw in the broader platform would likely be exploited on a far greater scale."


“I checked every transaction,” said [one] user, who goes by Neso. “They all have valid signatures from the people who lost NFTs so anyone claiming they didn’t get phished but lost NFTs is sadly wrong.”

"OpenSea co-founder and CEO Devin Finzer confirmed the phishing attack in a tweet." "Afterwards, Devin Finzer confirmed that this was a “phishing attack”, but it has not been possible to verify where the “phishing” occurred. The only thing that can be confirmed after investigation is that the phishing attack did not come from the inside of the OpenSea website."

On official statement was released by OpenSea at the time.

"Our leadership, engineering, and security teams are communicating with affected users to gather details. We continue to believe that this is a phishing attack that originated outside of http://opensea.io."

Community Reactions

There were several reactions on Twitter[38].

Are you guys doing anything to help make this right with customers like me that lost our NFTs???

Ultimate Outcome

Most of the unsold NFTs were returned to victims. In addition, one victim received an "inexplicabl[e]" payment of 50 ETH ($130,000) from the attacker.

1,115 ETH, worth an estimated $2.9m, were transferred from the attacker to a cryptocurrency tumbler.

The attacker's wallet address has been flagged on Etherscan[42].

Total Amount Recovered

Most of the unsold NFTs were returned to victims, with some returns starting almost immediately[32]. In addition, one victim received an "inexplicabl[e]" payment of 50 ETH ($130,000) from the attacker.

"Hackers return most of the unsold NFTs to victims." "Bizarrely, the hacker returned some of the NFTs to their original owners, and one victim inexplicably received 50 ETH ($130,000) from the attacker as well as some of his stolen NFTs back. The attacker later transferred 1,115 ETH obtained from the attack to a cryptocurrency tumbler, worth around $2.9 million."

The total amount recovered has been estimated at $1,700,000 USD.

Ongoing Developments

"[M]any details of the attack remain unclear — particularly the method attackers used to get targets to sign the half-empty contract. Writing on Twitter shortly before 3AM ET, OpenSea CEO Devin Finzer said the attacks had not originated from OpenSea’s website, its various listing systems, or any emails from the company. The rapid pace of the attack — hundreds of transactions in a matter of hours — suggests some common vector of attack, but so far no link has been discovered."

"We're reaching out to the folks who reported this to investigate. Please continue to be vigilant when prompted with a wallet signature."

Individual Prevention Policies

This situation appears to be related to targeted phishing attacks against OpenSea users. Users in the DeFi space need to exercise a high degree of caution in all communications to ensure that they are coming from the claimed sender. Users should ensure they are aware of which actions which could place their funds at risk. Signing of any smart contract from an unaudited source is not a good idea, particularly a partially formed smart contract. Storing most NFTs offline can prevent them from being lost in the event of a breach.

Set up separate email addresses for each service, and avoid providing your phone number whenever possible. Any received emails or phone calls must be viewed with scrutiny, especially if unsolicited. Interact with companies only through their official websites and confirm anything with the company directly via multiple official sources, especially if it promises a significant incentive to take an action or threatens access to your funds if an action is not taken. It would be recommended to also establish a network of multiple trusted individuals who use the same services and have a strong level of security knowledge.

Every approval on Web3 is an opportunity to lose all of the funds present in your wallet. Take the time to review the transaction in full. Fully check over the balance, permissions, and entire address which you are interacting with. Do not trust that your clipboard or any website front-end is guaranteed to provide an accurate address or transaction status. Always perform a test transaction prior to the first high-value transaction in any session.

Avoid the use of smart contracts unless necessary. Minimize the level of exposure by removing or withdrawing assets whenever possible. Aim to choose smart contracts which have obtained third party security audits, preferably having been audited by at least three separate reputable firms. Pay attention to the audit reports, which smart contracts are covered, and whether the smart contract has been upgraded or modified since the report. Ensure that any administrative functions with the ability to remove funds from the smart contract are under the authority of a multi-signature wallet which is controlled by at least three separate and reputable entities.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

The primary defense against phishing is better education for users. Ensure that users have an understanding of the risks and strategies to protect themselves.

Never take for granted the limited knowledge of users of your service and their tendency to skip past provided information. It is recommended to design a simple tutorial and quiz for new users which explains the basics of seed phrases, strong password generation, secure two-factor authentication, common fraud schemes, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space. This tutorial and quiz should ensure their understanding and be a standard part of the sign-up or download process which is difficult or impossible to skip.

In the event that a user falls for a phishing attack, an industry insurance fund could assist.

Work with other industry platforms to set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

The primary defense against phishing is better education for users. Ensure that users have an understanding of the risks and strategies to protect themselves.

Create a standard tutorial and quiz for all new cryptocurrency participants, which is required to be completed once per participant. This tutorial and quiz should cover the basics of proper seed phrase protection, strong password generation, secure two-factor authentication, common fraud schemes, how to detect and guard against phishing attacks, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space.

In the event that a user falls for a phishing attack, an industry insurance fund could assist.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.

References

  1. ↑ How OpenSea took over the NFT trade - The Verge (Mar 10, 2022)
  2. ↑ Dune Analytics (Mar 10, 2022)
  3. ↑ @dfinzer Twitter (Mar 10, 2022)
  4. ↑ OpenSea Says Phishing Attack Impacted 17 Users (Mar 10, 2022)
  5. ↑ Scam artists swindle NFTs worth 'millions' in OpenSea phishing attack | ZDNet (Mar 10, 2022)
  6. ↑ OpenSea phishing scandal reveals a security need across the NFT landscape (Mar 10, 2022)
  7. ↑ OpenSea Says at Least $1.7M in NFTs Stolen in Phishing Attack - CNET (Mar 10, 2022)
  8. ↑ NFT Investors Lose $1.7M in OpenSea Phishing Attack | Threatpost (Mar 10, 2022)
  9. ↑ @opensea Twitter (Mar 10, 2022)
  10. ↑ @opensea Twitter (Mar 10, 2022)
  11. ↑ @opensea Twitter (Mar 10, 2022)
  12. ↑ Phishing attack from OpenSea to analyze blockchain hacking methods - CoinYuppie: Bitcoin, Ethereum, Metaverse, NFT, DAO, DeFi, Dogecoin, Crypto News (Mar 16, 2022)
  13. ↑ https://www.cpomagazine.com/cyber-security/phishing-attack-on-nft-marketplace-opensea-results-in-thefts-from-17-accounts-victims-tricked-into-signing-malicious-payloads/ (Mar 20, 2022)
  14. ↑ https://etherscan.io/tx/0xdfa95e85496c489e7f3b2dbe570ed2b261c3390443c8f6053eb6d76acd30c5e9 (Jul 21, 2022)
  15. ↑ Tenderly Dashboard (Jul 21, 2022)
  16. ↑ @TalBeerySec Twitter (Jul 21, 2022)
  17. ↑ OpenSea Loses NFTs Worth $1.7 Million in Phishing Attack, Investigation Underway | Technology News (Feb 6, 2023)
  18. ↑ 18.0 18.1 18.2 18.3 OpenSea - "Our leadership, engineering, and security teams are communicating with affected users to gather details. We continue to believe that this is a phishing attack that originated outside of http://opensea.io." - Twitter (Feb 6, 2023)
  19. ↑ OpenSea Homepage (Mar 9, 2022)
  20. ↑ About - OpenSea (Mar 9, 2022)
  21. ↑ OpenSea Documentation (Mar 9, 2022)
  22. ↑ Frequently Asked Questions - OpenSea (Mar 9, 2022)
  23. ↑ OpenSea - "Meet OpenSea | The NFT marketplace with everything for everyone" - YouTube (Mar 9, 2022)
  24. ↑ The Verge - NFTs and the $13B marketplace, explained - YouTube (Mar 10, 2022)
  25. ↑ Malicious Transfer of AJFromDiscord's NFTs - Etherscan (Apr 6, 2023)
  26. ↑ AJFromDiscord - "ALL OF OUR STOLEN NFT'S WERE ONES WE MANUALLY MIGRATED ON OPENSEA" - Twitter (Mar 10, 2022)
  27. ↑ Jon_HQ - "I am very unsure how this is working or what is being exploited but it seems that OpenSea's new contract is ab[so]lutely rugged." - Twitter (Mar 10, 2022)
  28. ↑ MikeBurgersburg - "578 Ethereum (~$1.7 million) transferred from dozens of wallets through opensea to a hacker." - Twitter (Mar 10, 2022)
  29. ↑ 29.0 29.1 Nesotual - "Seen confusion about the OS thing so. Attacker had people sign half of a valid wyvern order, the order was basically empty except the target (attacker contract) and calldata, attacker signs other half of order." - Twitter Archive February 20th, 2022 7:48:29 AM MST (Mar 10, 2022)
  30. ↑ 30.0 30.1 Seventeen OpenSea users have their NFTs stolen and flipped for a total of $2.9 million by a phishing scammer – Web3 Is Going Just Great (Mar 10, 2022)
  31. ↑ 31.0 31.1 web3isgreat - "[UPDATE]: OpenSea users panic as at least $1.7 million in NFTs are stolen" - Twitter (Apr 6, 2023)
  32. ↑ 32.0 32.1 32.2 32.3 32.4 Devin Finzer - "For more technical context, this thread is consistent with our current internal understanding." - Twitter (Mar 10, 2022)
  33. ↑ $1.7 million in NFTs stolen in apparent phishing attack on OpenSea users - The Verge (Mar 9, 2022)
  34. ↑ 34.0 34.1 Nadav Hollander - "None of the malicious orders were executed against the new (Wyvern 2.3) contract, indicating that they were signed before the migration and are unlikely to be related to OpenSea’s migration flow." - Twitter (Feb 6, 2023)
  35. ↑ opensea - "We’ve narrowed down the list of impacted individuals to 17, rather than the previously mentioned 32." - Twitter (Mar 10, 2022)
  36. ↑ Phishing Attack Strikes ‘Moonbirds’ NFT Project, Details Here - Techsprout News (Aug 23, 2022)
  37. ↑ Nesotual - "Million and one ways to phish someone, but the private key to the addresses that owned the nfts signed a hash for the exploit order at some point, you can be certain of that." - Twitter Archive February 19th, 2022 7:40:06 PM MST (Dec 19, 2023)
  38. ↑ 38.0 38.1 Shalerhouser - "Are you guys doing anything to help make this right with customers like me that lost our NFTs???" - Twitter (Dec 19, 2023)
  39. ↑ SlowMist Hack List Page 18 - SlowMist (Apr 6, 2023)
  40. ↑ Opensea Phishing Incident Stole NFT List - Google Sheet Archive (Apr 6, 2023)
  41. ↑ Opensea Phishing Incident Stolen NFT List - Google Sheets (Mar 9, 2022)
  42. ↑ Attacker's Wallet Address - Etherscan (Mar 10, 2022)

Cite error: <ref> tag with name "slowmist-2069" defined in <references> is not used in prior text.

Retrieved from "https://quadrigainitiative.com/cryptocurrencyhackscamfraudwiki/index.php?title=OpenSea_Phishing_Attack&oldid=5336"