Moonbirds NFT Trading Fraud

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Moonbirds

One holder of many Moonbirds NFTs, who happens to be a father with young children, was befriended by an online "trader" who later offered to purchase his NFTs. However, the "trader" directed him to use a malicious website to facilitate the trade. This website was able to steal all his NFTs (worth $1.5m) after he granted it permission.

The "trader" did not do a very good job of covering their tracks and had interacted with multiple exchange platforms previously, so their identity was likely compromised. They were requested to return the funds. There is no clear word if any NFTs were returned.

This is a global/international case not involving a specific country.

About Moonbirds

"Moonbirds are more than just an avatar. They're a collection of 10,000 utility-enabled PFPs that feature a richly diverse and unique pool of rarity-powered traits. What's more, each Moonbird unlocks private club membership and additional benefits the longer you hold them. We call it nesting – because, obviously."

"Once inside, you will have exclusive access to Moonbird-related drops, Parliament meetups and IRL events, and access to upcoming PROOF projects; including the PROOF metaverse, codenamed Highrise."

"The money collected by via this Moonbirds project goes to PROOF Holdings, a True Ventures backed Web3 media company that brings together NFT artists and creators."

“We have big plans and this funding will be used solely to expand our team and launch new products — ultimately creating additional value for our community,” the project website says.

"Keith said that [someone] befriended him on Twitter weeks ago, and they sometimes spoke via DMs on the website about Moonbirds, until he offered to buy his NFTs on Tuesday night."

"29 Moonbirds were just stolen in a hack. ~750e (~$1,500,000) in value lost by clicking on a bad link."

"A Proof Collective member has fallen victim to a scam, losing 29 highly-valuable Ethereum (ETH)-based Moonbirds. According to a tweet by Cirrus on Wednesday morning, the victim lost 29 Moonbird nonfungible tokens (NFTs) worth $1.5 million after clicking a malicious link shared by a scammer."

The scammer “hacked a father of three children under 6-years-old and a wife, and took all their hard earned money for the past 38 years accrued in a few minutes," the victim said.

"The victim, who goes by Keith “Digital Ornithologist" on Twitter, told Motherboard that the hacker sent him to a phishing website set up with a smart contract, which he approved."

“On that site [the hacker] had a contract made to un-nest all my Moonbirds and move them in one swoop,” he said in an online chat, adding that at first it appeared the transactions were failing but eventually went through.

“No words can describe the level of life altering results this has caused,” he said. “I'm a doctor that takes care of patients with end stage pain (cancer) and have done much for the web3 community to thrive and grow.”

"Sounds like the scammer linked the victim to a fake trading site and got him to sign a bad transaction. Hard wallets dont stop this. Please always be wary of what you are signing when confirming a transaction."

“The hackers tried to be more ‘stealth’ in the beginning and use a smart contract in the transaction for the victim to sign, but when they failed to operate it they resorted to using their ‘regular’ address (not a contract) convince the victim to sign again and it worked,” Tal Be’ery, who is the chief technology officer of ZenGo, a crypto wallet app, said.

"Ethereum blockchain explorer Etherscan shows the flurry of transactions from the victim’s wallet to the hacker in the last few hours. The 29 NFTs are flagged for “suspicious activity” on NFT trading platform OpenSea."

"This guy is really lucky, all of the moonbirds has been frozen so he will get them back. May this be a wise lesson."

"The wallet with the stolen birds just got airdropped this notice..."

"Please return the stolen moonbirds to the original owner. Keep 1 for compensation. If MBs are not returned by 5/25 @ 12p UTC, the police and FBI will be notified formally."

"That'll be a long shot. What moonbirds team can do is threaten to destroy the NFT he had stolen and becomes worthless. From now on, each of the stolen NFT must be watermarked by the team as STOLEN. So secondary buyers will be aware."

"The hacker’s alleged Twitter account has since been deleted."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

Known history of when and how the service was started.
What problems does the company or service claim to solve?
What marketing materials were used by the firm or business?
Audits performed, and excerpts that may have been included.
Business registration documents shown (fake or legitimate).
How were people recruited to participate?
Public warnings and announcements prior to the event.

Don't Include:

Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

When the service was actually started (if different than the "official story").
Who actually ran a service and their own personal history.
How the service was structured behind the scenes. (For example, there was no "trading bot".)
Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Moonbirds NFT Trading Fraud
Date	Event	Description
May 24th, 2022 8:59:00 PM	Main Event	Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.

Total Amount Lost

The total amount lost has been estimated at $1,500,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

The total amount recovered is unknown.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Prevention Policies

When trading, never use a new exchange platform without first obtaining multiple credible recommendations. Bookmark the official website of every exchange. Keep the majority of funds offline and never have more funds than necessary in your current active wallet.

Our framework would provide for an easy list of platforms which can be used safely, and a method of handling any issues with those platforms losing assets.