Memeland Discord Server Compromised

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' and 'General Prevention' sections to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Memeland

Memeland used MEE6, a widely implemented Discord bot which assists with ranking and moderation functions. MEE6 had administrative level access to a wide range of Discord servers where it was set up. One of the MEE6 employee accounts was compromised, and the attackers used that to run widespread phishing attacks on multiple NFT communities, including Memeland. Memeland was particularly susceptible due to the lack of a concrete roadmap, and the NFT space often has a wide range of time-sensitive opportunities. It's unclear exactly how many users were affected, and it seems that no funds have been recovered. MEE6 has apparently not published further details about what happened.

This is a global/international case not involving a specific country.

About Memeland

"BRING OWNERSHIP TO EVERY COMMUNITY IN THE WORLD. From the team that brought you 9GAG comes Memeland, a web3-focused venture studio. We are building and investing in social products for community, with community. We are connecting creators and communities together through creativity, $MEME, and NFTs."

"Memeland is a collection of 9,999 utility-enabled PFPs." "They ran a blind auction for “YOU THE REAL MVP” to let their community set the price. The final price goes to 5.3 ETH, and now FP sits at 32 ETH." "“The Potatoz” is a collection of 9,999 utility-enabled PFPs launched on Jul. 21 [2022]. Each Potatoz is your entry ticket into the great Memeland ecosystem." "The Potatoz completing more than 9,700 ETH ($16 million) worth of secondary marketplace transactions up to now. The floor price for The Potatoz is currently 1.45 ETH."

"Founded in 2008, 9GAG behind Memeland NFT has a global audience of 200 million, across its website, apps, Instagram, Facebook, and Twitter." "When we started 9GAG in 2008, we were nobody, and we knew nothing. We joined 500 Startups in 2011, raised seed funding, joined Y Combinator in 2012, and never stopped shipping. A decade later, we are still nobody, but 9GAG now has a global audience of 200 million across different social platforms." "Famous celebrities like @kevinrose and @garyvee are all involved in this project."

"Today, we are trying something new. With the help of blockchain technology, we want to invite you to join us and build our community and company together. As with all things 9GAG, we like to under-promise and over-deliver. We don't know how big Memeland will become, but we promise we will give our best." "Elements like a broken sea, pirate crews, treasure island, sea monster, and of course…memes are all showing in the form of really cool pixels."

"On top of it, Memeland does not have a specific roadmap and follows a dynamic plan." "They said that there is no road at sea, so there is no roadmap." "Go slow to go fast." "Mint date? Not today. Mint price? Not cheap. Roadmap? No roadmap. What now? Follow @MEMELAND." "We made our announcement only 1 month ago. Web3 moves fast but we are here to stay. Good things take time."

"[H]olders of Memeland PFPs have full commercial art rights for the Memeland PFPs they own." "Memeland will receive 6.9% of all secondary sales." "Unlike lonely NFTs which can only be held in your wallet, Memeland is going to give you value and each Memeland PFP (aka Captain) unlocks utilities like Private club membership, Exclusive access to the creator NFT marketplace, IRL (In Real Life) events, Upcoming 9GAG drops and projects, And more."

"MEE6 is a 2-year-old Discord bot known for Levels, Auto-moderation, and its' paid music/record features. We also offer Reddit/Twitch/YouTube notifications, timers, custom commands, and other moderation features." "The best Discord Bot for your server." "Configure moderation, leveling, Twitch alerts, and much more with the most easy-to-use dashboard!" "Take advantage of the welcome message to inform newcomers about your server rules, topic, or ongoing events. You can design your own welcome card or keep it simple."

"MEE6 gives you full control to create the command of your dreams! Create commands that automatically give and remove roles and send messages in the current channels or in user's DM." "Notify your server when you or your favorite content creators begin to stream, upload, and post content." "MEE6, the Discord Bot trusted by 19+ million servers." "Mekaverse, Doodles, CyberKongz, VeeFriends, CoolCats, and RTFKT all use MEE6 everyday to manage their Discord server. More than 60,000 NFT & crypto Discord servers setup MEE6 every month, and that number is growing fast."

"Another tweet was shared by PeckShield, a blockchain cybersecurity firm, warning users about compromised NFT Discord Server of Memeland, RTFKT, PROOF/Moonbirds and infrastructure company Cyberconnect."

"YOUR DISCORD IS HACKED, CHECK ANNOUCEMENT, SOMEONE SENDED SCAM LINK, ALL CHANEL ARE CLOSED."

"Cyberconnect and Memeland confirmed the hack on their Twitter feeds and warned users to avoid clicking on any link on Discord. Cyberconnect caution that the project will never ask for their private keys." "Memeland also alerted users on Twitter and inside Discord, where the project posted a message saying a compromised bot posted announcements with “fake links.”"

"@NFTherder singled out the MEE6 Discord bot as problematic. This Discord plugin, used by over 18 million servers, allows users to assign roles themselves by using Discord reactions. It is also a basic moderator and can send administration messages."

"26 of the 70 discords [compromised in May 2022] were compromised through the @mee6bot." "Turns out there was some truth about the MEE6 compromise: MEE6 wasn't hacked itself however an employee of their company had their account breached & scammers used that account to execute their scam. Question is, did the employee fall for a phishing link or was it a bribe? Crazy."

"A team member of Memeland noted, “a discord bot (mee6) seems to be compromised across various high profile servers.” The mee6 bot is used by the server owners to automate welcome messages and inform about the server rules, events and topics."

"MEE6's employee account was breached & scammers used that account to execute the scams and steal eth. MEE6 support denied it for hours yesterday [before later admitting what happened]."

MEE6 released a statement after the event: "Some servers have reported MEE6 being used to post unwanted messages. There is no technical breach in our systems. This was due to one of our employee's account getting compromised. The issue is now fixed and we've taken all the steps to make sure it never happens again. We take security very seriously, and will always be committed not only to keep our systems safe but also add extra measures to protect servers from accounts being compromised."

NFTHerder reports he "reached out to affected servers as well and they confirmed MEE6 hasn't shared a detailed report or offered reimbursements of misappropriated nfts/eth." "MEE6 has yet to release a detailed report." "[N]o intentions to refund. [T]hey won’t release a public statement cause scared of fud. [E]mployees can still remote access any server."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Memeland Discord Server Compromised

Date	Event	Description
May 17th, 2022 8:17:00 PM MDT	Main Event	Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.

Total Amount Lost

The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

General Prevention Policies

The primary issue was related to the security of the Discord server, which granted additional unnecessary permissions to the MEE6 bot. The widespread bot access should not fall under the control of a single employee or system, which may form a fundamental design limitation of Discord or the MEE6 bot system.

NFT traders can avoid falling victim to such fraud by not making rushed decisions, double checking any promotions against multiple sources, and avoiding any mints that seem to be too good to be true.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.