Beeple Twitter Account Hack

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Beeple Mint scam website.

Beeple was an extremely successful NFT artist, with works selling for upwards of $69.3m in auctions. On May 22nd, 2022, his Twitter account was compromised and the attackers used their access to launch two separate phishing attacks on his followers, netting them a total of $438k. It does not appear that any of the funds have been recovered.

About Beeple

Beeple was a well known NFT artist who created three of the top ten most expensive NFTs sold to date. One of those, his "first 5,000 days", sold for $69.3 million, the most expensive NFT ever sold to a sole owner.

Earlier in May, NFT creator Beeple designed 30 NFTs for Louis Vuitton’s "Louis The Game" mobile game, which were embedded within the game as player rewards.

On the early morning of May 22nd, 2022, the official account of Beeple posted about an exciting new raffle.

"Been working on this with [Louis Vuitton] for a long time behind the scenes. 1000 total unique pieces.
BEEPLE x VUITTON COLLECTION_!: BEEPLES
Official Raffle Below. 1 ETH = 1 Raffle Entry. All non-winning entries are refunded post raffle.
Good luck :)"

This was follows by yet another promotion - this time a free mint!

"Had felt the need to release more NFTs from my collection behind the scenes. 200 total unique pieces.
BEEPLE - SPRING/SUMMER COLLECTION 2021
Official Minting Link Below. FREE mint! 200 UNIQUE pieces for everyone!
Good luck :)"

The Reality

Beeple's account had been hacked and the raffle was not real. Users who participated simply forfeited their ETH.

"On 2022-05-15, the domain was pointed to 45.61.136.112 which hosts malicious scam domains." "IP 44.227.238.106 is such an innocent piece of infra, cleaner than melted glacier water."

The first exploit was later explained by @sniko_:

"Once you've connected your wallet, will initiate a mint() contract call to 0x7b69c4f2ACF77300025E49DbDbB65B068b2Fda7D, which will send 1ETH to the contract." "As of typing the website is not weaponised to "drain" wallets by filling the wallet tx queue (like we've seen before)" "The contract you are sending a transaction to is in fact a 721 contract, with mint() function defined as: The owner of the contract can withdraw the funds at any moment"

The second attack was "a little more sophisticated than the first, having a Discord C2 - still investigating. Potentially targets NFTs with setApprovalForAll()"

What Happened

Digital artist and popular nonfungible token (NFT) creator Mike Winkelmann, more commonly known as Beeple, had his Twitter account hacked on Sunday as part of a phishing scam. The phishing links lasted roughly 5 hours.

Key Event Timeline - Beeple Twitter Account Hack
Date	Event	Description
March 11th, 2022 8:02:00 AM	Record NFT Sale	The auction price of Beeple's NFT "EVERYDAYS: THE FIRST 5000 DAYS" exceeds $60m.
May 22nd, 2022 3:20:00 AM	First Exploit	The very first minting transaction happens, stealing ethereum from an account named "legalguy.eth".
May 22nd, 2022 4:24:00 AM	Twitter Report	The first hack is reported on Twitter by user @_sniko. At the time of that tweet, losses were reported as 25 ETH/$50k.
May 22nd, 2022 5:21:00 AM	Second Tweet	The second compromised tweet is posted on Twitter by @beeple's account. It succeeds to have transfers almost immediately.
May 22nd, 2022 5:41:00 AM	Twitter Report	The second hack is reported on Twitter by user @_sniko. "Bad actors continue have access to Beeples Twitter account and they have now tweeted another phishing domain. This one seems a little more sophisticated than the first, having a Discord C2 - still investigating. Potentially targets NFTs with setApprovalForAll()"
May 22nd, 2022 6:19:00 AM	Final Exploit	The final "setApprovalForAll" transaction is done as part of the first phishing attack.
May 22nd, 2022 8:02:00 AM	Final Exploit	The final "setApprovalForAll" transaction is done as part of the second phishing attack.
May 22nd, 2022 8:21:00 AM	Twitter Report	Beeple regains control of their account and posts a tweet. "Twitter was hacked but we have control now."

Total Amount Lost

CoinTelegraph reports that the scam earned the attacker $438K in cryptocurrency and NFTs from the compromised Beeple account.

There were multiple phishing links posted through the Beeple account. The first netted roughly $73,000. The second netted $365,000 worth of ethereum and several high profile "from high-value collections such as the Mutant Ape Yacht Club, VeeFriends and Otherdeeds", with the grand total being roughly $438,000.

Twitter user @sniko_ reached the same total via a slightly different calculation.

"Scam #1
36ETH (~$72k) 0xf305 is yet to withdraw
Scam #2 62.35ETH (~$125k) 37.59WETH (~$75k) 45 NFTs (est ~$166k)
Total = $438k (active for ~5hours)"

The total amount lost has been estimated at $438,000 USD.

Immediate Reactions

Multiple posts were shared by @sniko_ on Twitter to warn other users.

Beeple's Twitter account has been compromised (ATO) to post a phishing website to steal funds.

Bad actors continue have access to Beeples Twitter account and they have now tweeted another phishing domain. This one seems a little more sophisticated than the first, having a Discord C2 - still investigating. Potentially targets NFTs with setApprovalForAll().

Examples of victims were Twitter users @Helisegundo and @nfactes:

"Dumbly I have clicked on the link and connected my wallet and been scammed. Damn I've check again and they also stole 2 of my nfts"

"with all due respect but lost 1 eth believing it was a real account. What I should do now?"

Ultimate Outcome

Beeple regained control of his account and posted to announce the fraud, calling it "too good to be true" that there would be a free mint and criticizing those who fell for it.

ugh we’ll that was fun way to wake up.
Twitter was hacked but we have control now. Huge thanks to @garyvee ‘a team for quick help!!!!
Stay safe out there, anything too good to be true IS A FUCKING SCAM.
And as side note, there will never be a SURPRISE MINT I mention one time in one place starting at 6am Sunday morning.

Total Amount Recovered

It does not appear that any recovery has been obtained for any users affected. Quoting @super1said:

"They dont Care bro. We are nobody the Guy had more then 156 nfts stolen and alreadly sold more then 80 of them my trust in this shit nfts is getting smaller by the day"

There do not appear to have been any funds recovered in this case.

Ongoing Developments

There don't appear to be any ongoing events remaining.

Prevention Policies

This can be prevented through exercising care whenever interacting with any smart contract or making any payment. The user must ensure that they understand the transaction prior to sending any funds or approvals.