Moonbirds NFT Trading Fraud

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Moonbirds

One holder of many Moonbirds NFTs, who happens to be a father with young children, was befriended by an online "trader" who later offered to purchase his NFTs. However, the "trader" directed him to use a malicious website to facilitate the trade. This website was able to steal all his NFTs (worth $1.5m) after he granted it permission.

The "trader" did not do a very good job of covering their tracks and had interacted with multiple exchange platforms previously, so their identity was likely compromised. They were requested to return the funds. There is no clear word if any NFTs were returned.

About Moonbirds

Website:

Video:

"Moonbirds are more than just an avatar. They're a collection of 10,000 utility-enabled PFPs that feature a richly diverse and unique pool of rarity-powered traits. What's more, each Moonbird unlocks private club membership and additional benefits the longer you hold them. We call it nesting – because, obviously."

"Once inside, you will have exclusive access to Moonbird-related drops, Parliament meetups and IRL events, and access to upcoming PROOF projects; including the PROOF metaverse, codenamed Highrise."

"The money collected by via this Moonbirds project goes to PROOF Holdings, a True Ventures backed Web3 media company that brings together NFT artists and creators."

“We have big plans and this funding will be used solely to expand our team and launch new products — ultimately creating additional value for our community,” the project website says.

"Keith said that [someone] befriended him on Twitter weeks ago, and they sometimes spoke via DMs on the website about Moonbirds, until he offered to buy his NFTs on Tuesday night."

"29 Moonbirds were just stolen in a hack. ~750e (~$1,500,000) in value lost by clicking on a bad link."

"A Proof Collective member has fallen victim to a scam, losing 29 highly-valuable Ethereum (ETH)-based Moonbirds. According to a tweet by Cirrus on Wednesday morning, the victim lost 29 Moonbird nonfungible tokens (NFTs) worth $1.5 million after clicking a malicious link shared by a scammer."

The scammer “hacked a father of three children under 6-years-old and a wife, and took all their hard earned money for the past 38 years accrued in a few minutes," the victim said.

"The victim, who goes by Keith “Digital Ornithologist" on Twitter, told Motherboard that the hacker sent him to a phishing website set up with a smart contract, which he approved."

“On that site [the hacker] had a contract made to un-nest all my Moonbirds and move them in one swoop,” he said in an online chat, adding that at first it appeared the transactions were failing but eventually went through.

“No words can describe the level of life altering results this has caused,” he said. “I'm a doctor that takes care of patients with end stage pain (cancer) and have done much for the web3 community to thrive and grow.”

"Sounds like the scammer linked the victim to a fake trading site and got him to sign a bad transaction. Hard wallets dont stop this. Please always be wary of what you are signing when confirming a transaction."

“The hackers tried to be more ‘stealth’ in the beginning and use a smart contract in the transaction for the victim to sign, but when they failed to operate it they resorted to using their ‘regular’ address (not a contract) convince the victim to sign again and it worked,” Tal Be’ery, who is the chief technology officer of ZenGo, a crypto wallet app, said.

"Ethereum blockchain explorer Etherscan shows the flurry of transactions from the victim’s wallet to the hacker in the last few hours. The 29 NFTs are flagged for “suspicious activity” on NFT trading platform OpenSea."

"This guy is really lucky, all of the moonbirds has been frozen so he will get them back. May this be a wise lesson."

"The wallet with the stolen birds just got airdropped this notice..."

"Please return the stolen moonbirds to the original owner. Keep 1 for compensation. If MBs are not returned by 5/25 @ 12p UTC, the police and FBI will be notified formally."

"That'll be a long shot. What moonbirds team can do is threaten to destroy the NFT he had stolen and becomes worthless. From now on, each of the stolen NFT must be watermarked by the team as STOLEN. So secondary buyers will be aware."

"The hacker’s alleged Twitter account has since been deleted."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

About P2Peers NFT Exchange

P2Peers gave the impression of being a simple and safe trading platform, with simple instructions for users to perform an NFT trade.

Easily EXCHANGE your NFTs with p2peers. Simple. Safe. Reliable. Your NFT swapping platform p2peers many2many NFTs in a safe and a easy way.

The website provided simple instructions for users on how they could complete their NFT swap.

Approve your NFTs.

To make swapping possible, we need to be able to transfer tokens on your behalf and only once per contract.

Propose the swap.

To propose the swap you need to select the NFTs you want to trade and fill in the counterparts address on the input field

Accept the swap.

The last step to swapping your NFTs is accepting the swap after getting an offer from the counterparty

The website featured a logo, elaborate "roadmap" timeline of upcoming development, and requests to follow social media accounts of the exchange.

The Reality

P2Peers was a fraudulent exchange platform, which was designed to trick the user into giving up wallet permissions. Once users approved what they thought was a simple trade, their entire wallet could be drained. Minimal information was provided on the website about who was behind the service.

The P2Peers platform was owned and operated by an individual with a shady past involving multiple previous frauds.

What Happened

A scammer tricked multiple Moonbirds NFT holders into using a questionable NFT trading platform to sell their NFTs, which ultimately robbed them of all NFTs held in their wallets.

Key Event Timeline - Moonbirds NFT Trading Fraud

Date	Event	Description
May 24th, 2022 8:59:00 PM MDT	CirrusNFT Posts On Twitter	The news of the attack is announced on Twitter by user CirrusNFT. They note that 29 Moonbirds were stolen and list the losses as ~750e ($1,500,000) before ending with a warning to the community.
May 24th, 2022 9:11:00 PM MDT	Shady Platform Discussion	CirrusNFT reports that the scam was being performed by tricking victims into using a shady exchange platform. Another user crypt0savage on Twitter forward an experience with a scammer insisting on using a shady platform for the transaction. TBD is this related?
May 24th, 2022 9:21:00 PM MDT	Airdropping Threat Notice	A notice is airdropped to the thief warning that "[i]f [Moonbirds] are not returned by 5/25 @ 12p UTC, the police and FBI will be notified formally.", allowing them to "[k]eep 1 for compensation", and claiming to be signed by "hoots.xyz".
May 25th, 2022 12:16:00 AM MDT	Incog Shares Guide	A tweet with more detail about the sites and scams is shared in response by Twitter user Incog.
May 25th, 2022 2:47:56 AM MDT	CoinTelegraph Article	CoinTelegraph publishes an article on the situation. TBD review. No significant changes to the article over time.
May 25th, 2022 4:00:00 AM MDT	Warning About Trading Platform	Another notice and analysis is shared by Twitter user Andeh. The trading platform used TBD review and add details.
May 25th, 2022 6:30:00 AM MDT	Confirmed Due To Rogue Approve	Blockchain security research manager Tal Be'ery confirms that the incident happened due to a rogue approval.
May 26th, 2022	Techsprout News Coverage	Techsprout News published an article on the situation. TBD review.
May 29th, 2022 10:23:00 AM MDT	Referenced By Nftherder	The incident is referenced by NFTherder in response to a post claiming "these scams are so dumb".

Technical Details

The scam was conducted using the website p2peers.io

This is the official Tx. ➼

@DVincent_ (hacker) wallet is (0x7ccf) and he is now approved as the operator of the victims wallet (0x5afcab) to transfer from the Moonbirds contract. ➼ I don't have evidence on how this happened, probably an approval function on the website.

➼ He goes on to transfer 29 Moonbird NFTs from victims wallet to his in less than 5 hours. ➼ He also takes other NFT's also.

This is @Dvincent_ (hacker) NFT wallet in Debank. ➼ He has just under $700k estimated value worth of NFTs after this attack. ➼ He also has other PROOF collection NFT's from the same victim.

I couldn't find @Dvincent_ on the internet, it was too hard. ➼ I was able to lookup the http://p2peers.io website he used, and it was been involved in MANY scams. ➼ As expected, most of the owner details are hidden. ➼ We do see the registrar is http://sarek.fi

Then, I did a lookup of the http://sarek.fi domain registrar servers: ➼ This website was started in 2019. ➼ Belongs to an address in Finland. ➼ Owner is (recorded as) Sarek Oy and his telephone / mailing address is public.

➼ Both http://sarek.fi AND http://p2peers.io have been used in previous scams. ➼ I am actively searching for ways to continue this investigation but this may be a deadend until more is found.

Here are some associated wallets with the hacker: ➼0xe8250Bb4eFa6D9d032f7d46393CEaE18168A6B0D ➼0x8e73fe4d5839c60847066b67ea657a67f42a0adf ➼0x6035B92fd5102b6113fE90247763e0ac22bfEF63 ➼0xBf41EFdD1b815556c2416DcF427f2e896142aa53 ➼0x29C80c2690F91A47803445c5922e76597D1DD2B6

Total Amount Lost

CirrusNFT provided that a total of 29 NFTs were taken and estimated the total losses as ~750 ethereum or $1,500,000 USD. They provided a picture of some of the stolen NFTs. The thief's wallet appears to be live on the blockchain.

The total amount lost has been estimated at $1,500,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

CirrusNFT was one of the first to report the situation on Twitter.

29 Moonbirds were just stolen in a hack.

~750e (~$1,500,000) in value lost by clicking on a bad link.

Sickening seeing stuff like this. Let this be a reminder to never ever click on links and to bookmark the marketplaces/trading sites that you use.

Twitter user Ouriel had some further questions.

curious to know where he got it from ? if that hacked his private key or just swept his bir[d]s with a smart contract

One user wanted to hunt down the perpetrator.

Def not funny. Let’s hunt this guy down…

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

The total amount recovered is unknown.

Ongoing Developments

It is likely that this individual is known to authorities and being pursued, however it is unclear to what stage any investigation would be in.

Individual Prevention Policies

When trading, never use a new exchange platform without first obtaining multiple credible recommendations. Bookmark the official website of every exchange. Keep the majority of funds offline and never have more funds than necessary in your current active wallet.

Any time that you are promised any profit or benefit in exchange for an initial payment, smart contract approval, or deposit, pay special care as to whether the entity making that offer is trustworthy, actually who they say they are, and has the means to fulfill what they're promising. There are no magic algorithms providing guaranteed returns from trading or mining. Trading on average will lose money. Mining is expensive and complex. No one is going to immediately send back more than you sent them. NFT projects will rarely announce a surprise mint in only a single location. Are you fully prepared for the event your money is kept and nothing is delivered in return?

Avoid the use of smart contracts unless necessary. Minimize the level of exposure by removing or withdrawing assets whenever possible. Aim to choose smart contracts which have obtained third party security audits, preferably having been audited by at least three separate reputable firms. Pay attention to the audit reports, which smart contracts are covered, and whether the smart contract has been upgraded or modified since the report. Ensure that any administrative functions with the ability to remove funds from the smart contract are under the authority of a multi-signature wallet which is controlled by at least three separate and reputable entities.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Never take for granted the limited knowledge of users of your service and their tendency to skip past provided information. It is recommended to design a simple tutorial and quiz for new users which explains the basics of seed phrases, strong password generation, secure two-factor authentication, common fraud schemes, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space. This tutorial and quiz should ensure their understanding and be a standard part of the sign-up or download process which is difficult or impossible to skip.

All aspects of any platform should undergo a regular validation/inspection by experts. This validation should include a security audit of any smart contracts, reporting any risks to the backing (of any customer assets, ensuring treasuries or minting functions are properly secured under the control of a multi-signature wallet, and finding any inadequacies in the level of training or integrity of the team. The recommended interval is twice prior to launch or significant system upgrade, once after 3 months, and every 6 months thereafter. It is recommended that the third party performing the inspection not be repeated within a 14 month period.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

Create a standard tutorial and quiz for all new cryptocurrency participants, which is required to be completed once per participant. This tutorial and quiz should cover the basics of proper seed phrase protection, strong password generation, secure two-factor authentication, common fraud schemes, how to detect and guard against phishing attacks, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space.

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

An easy list of platforms which can be used safely, and a method of handling any issues with those platforms losing assets could be provided.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.