Moonbirds NFT Trading Fraud

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' and 'General Prevention' sections to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Moonbirds

One holder of many Moonbirds NFTs, who happens to be a father with young children, was befriended by an online "trader" who later offered to purchase his NFTs. However, the "trader" directed him to use a malicious website to facilitate the trade. This website was able to steal all his NFTs (worth $1.5m) after he granted it permission.

The "trader" did not do a very good job of covering their tracks and had interacted with multiple exchange platforms previously, so their identity was likely compromised. They were requested to return the funds. There is no clear word if any NFTs were returned.

About Moonbirds

Website:

Video:

"Moonbirds are more than just an avatar. They're a collection of 10,000 utility-enabled PFPs that feature a richly diverse and unique pool of rarity-powered traits. What's more, each Moonbird unlocks private club membership and additional benefits the longer you hold them. We call it nesting – because, obviously."

"Once inside, you will have exclusive access to Moonbird-related drops, Parliament meetups and IRL events, and access to upcoming PROOF projects; including the PROOF metaverse, codenamed Highrise."

"The money collected by via this Moonbirds project goes to PROOF Holdings, a True Ventures backed Web3 media company that brings together NFT artists and creators."

“We have big plans and this funding will be used solely to expand our team and launch new products — ultimately creating additional value for our community,” the project website says.

"Keith said that [someone] befriended him on Twitter weeks ago, and they sometimes spoke via DMs on the website about Moonbirds, until he offered to buy his NFTs on Tuesday night."

"29 Moonbirds were just stolen in a hack. ~750e (~$1,500,000) in value lost by clicking on a bad link."

"A Proof Collective member has fallen victim to a scam, losing 29 highly-valuable Ethereum (ETH)-based Moonbirds. According to a tweet by Cirrus on Wednesday morning, the victim lost 29 Moonbird nonfungible tokens (NFTs) worth $1.5 million after clicking a malicious link shared by a scammer."

The scammer “hacked a father of three children under 6-years-old and a wife, and took all their hard earned money for the past 38 years accrued in a few minutes," the victim said.

"The victim, who goes by Keith “Digital Ornithologist" on Twitter, told Motherboard that the hacker sent him to a phishing website set up with a smart contract, which he approved."

“On that site [the hacker] had a contract made to un-nest all my Moonbirds and move them in one swoop,” he said in an online chat, adding that at first it appeared the transactions were failing but eventually went through.

“No words can describe the level of life altering results this has caused,” he said. “I'm a doctor that takes care of patients with end stage pain (cancer) and have done much for the web3 community to thrive and grow.”

"Sounds like the scammer linked the victim to a fake trading site and got him to sign a bad transaction. Hard wallets dont stop this. Please always be wary of what you are signing when confirming a transaction."

“The hackers tried to be more ‘stealth’ in the beginning and use a smart contract in the transaction for the victim to sign, but when they failed to operate it they resorted to using their ‘regular’ address (not a contract) convince the victim to sign again and it worked,” Tal Be’ery, who is the chief technology officer of ZenGo, a crypto wallet app, said.

"Ethereum blockchain explorer Etherscan shows the flurry of transactions from the victim’s wallet to the hacker in the last few hours. The 29 NFTs are flagged for “suspicious activity” on NFT trading platform OpenSea."

"This guy is really lucky, all of the moonbirds has been frozen so he will get them back. May this be a wise lesson."

"The wallet with the stolen birds just got airdropped this notice..."

"Please return the stolen moonbirds to the original owner. Keep 1 for compensation. If MBs are not returned by 5/25 @ 12p UTC, the police and FBI will be notified formally."

"That'll be a long shot. What moonbirds team can do is threaten to destroy the NFT he had stolen and becomes worthless. From now on, each of the stolen NFT must be watermarked by the team as STOLEN. So secondary buyers will be aware."

"The hacker’s alleged Twitter account has since been deleted."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

Incog Guide:

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Moonbirds NFT Trading Fraud

Date	Event	Description
May 24th, 2022 8:59:00 PM MDT	CirrusNFT Posts On Twitter	The news of the attack is announced on Twitter by user CirrusNFT. They note that 29 Moonbirds were stolen and list the losses as ~750e ($1,500,000) before ending with a warning to the community.
May 24th, 2022 9:11:00 PM MDT	Shady Platform Discussion	CirrusNFT reports that the scam was being performed by tricking victims into using a shady exchange platform. Another user crypt0savage on Twitter forward an experience with a scammer insisting on using a shady platform for the transaction. TBD is this related?
May 24th, 2022 9:21:00 PM MDT	Airdropping Threat Notice	A notice is airdropped to the thief warning that "[i]f [Moonbirds] are not returned by 5/25 @ 12p UTC, the police and FBI will be notified formally.", allowing them to "[k]eep 1 for compensation", and claiming to be signed by "hoots.xyz".
May 25th, 2022 12:16:00 AM MDT	Incog Shares Guide	A tweet with more detail about the sites and scams is shared in response by Twitter user Incog.
May 25th, 2022 2:47:56 AM MDT	CoinTelegraph Article	CoinTelegraph publishes an article on the situation. TBD review. No significant changes to the article over time.
May 25th, 2022 4:00:00 AM MDT	Warning About Trading Platform	Another notice and analysis is shared by Twitter user Andeh. TBD review and add details.
May 25th, 2022 6:30:00 AM MDT	Confirmed Due To Rogue Approve	Blockchain security research manager Tal Be'ery confirms that the incident happened due to a rogue approval.
May 26th, 2022	Techsprout News Coverage	Techsprout News published an article on the situation. TBD review.
May 29th, 2022 10:23:00 AM MDT	Referenced By Nftherder	The incident is referenced by NFTherder in response to a post claiming "these scams are so dumb".

Total Amount Lost

CirrusNFT provided that a total of 29 NFTs were taken and estimated the total losses as ~750 ethereum or $1,500,000 USD. They provided a picture of some of the stolen NFTs. The thief's wallet appears to be live on the blockchain.

The total amount lost has been estimated at $1,500,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

CirrusNFT was one of the first to report the situation on Twitter.

29 Moonbirds were just stolen in a hack.

~750e (~$1,500,000) in value lost by clicking on a bad link.

Sickening seeing stuff like this. Let this be a reminder to never ever click on links and to bookmark the marketplaces/trading sites that you use.

Twitter user Ouriel had some further questions.

curious to know where he got it from ? if that hacked his private key or just swept his bir[d]s with a smart contract

One user wanted to hunt down the perpetrator.

Def not funny. Let’s hunt this guy down…

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

The total amount recovered is unknown.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

General Prevention Policies

When trading, never use a new exchange platform without first obtaining multiple credible recommendations. Bookmark the official website of every exchange. Keep the majority of funds offline and never have more funds than necessary in your current active wallet.

Our framework would provide for an easy list of platforms which can be used safely, and a method of handling any issues with those platforms losing assets.

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.