View source for Rare Bears Scam Account

{{Case Study Under Construction}}[[File:Rarebearsnft.jpg|thumb|Rare Bears Logo/Homepage]]The Rare Bears NFTs are a set of NFT bears made by a New Zealand artist nicknamed Enox. A scam account was created on Twitter and posted links to a fake minting website, claiming to allow users to mint Rare Bears NFTs. They successfully scammed at least one user out of $2k worth of assets.

== About Rare Bears ==
Rare Bears are an NFT collection of 2,347 unique digital NFTs created by Iain Spanhake, an NFT artist from New Zealand commonly referred to as "Enox"<ref name="opensea-8508" /><ref name="opensea-10552" />. The first minting of the collection was launched on March 12th, 2022<ref name="bearsraretwitter-10559" /><ref name="rarebearsnft-8507" />. Rare Bears describes their NFTs in detail on their website<ref name="rarebearsnft-8507" /><ref name=":1">[https://rarebearsnft.com/ Rare Bears NFT Homepage] (Dec 8, 2023)</ref> and OpenSea<ref name="opensea-8508" />.<blockquote>"The Rare Bears are taking over. They’re cute and sweet, but tough and street. The Bears have a cool retro vibe mixed with a futuristic cyber tone. They’re all about street art, graffiti, music, tech, fashion, and a few old-school video games. They’re down to cuddle once in a while, but if you cross a Bear it’s bad news. The Rare Bears are your ticket into the BearVerse with the most vibrant community around. More NFTs will drop, collabs will happen and more mediums will be explored. We’re bearly getting started."</blockquote>On April 5th, 2022, an announcement appeared on the Rare Bears Discord channel<ref name="bearsraretwitter-10405" /><ref name=":2">[https://web.archive.org/web/20220405062415/https://twitter.com/EnoxxArt/status/1511228080806793218 "EnoxxArt" - "we plan to expand all the way around the world, while doing so we will need you to follow us through this ride, you are now able to obtain our rarest bears early with a presale now available" - Twitter Archive April 5th, 2022 12:24:15 AM MDT] (Dec 8, 2023)</ref>.<blockquote>"We are planning to expand all the way around the world, while doing so we will need you to follow us through this ride, you are now able to obtain our rarest bears early with a presale now available. Goodluck bears." "PRESALE IS LIVE NOW!"</blockquote>Users were invited to visit rarebears.org to mint Rare Bears for 0.12 ETH as part of an exclusive presale<ref name="bearsraretwitter-10405" />.

Website:<ref name=":1" />

Twitter:<ref name=":3">[https://twitter.com/BearsRare Rare Bears Twitter] (Dec 8, 2023)</ref>

LinkTree:<ref name=":4">[https://linktr.ee/rarebears Rare Bears Linktree] (Dec 8, 2023)</ref>

== The Reality ==
The announcement was not a real mint and was posted by phishing scammers on a separate Twitter account. The actual website of the Rare Bears NFT project is rarebearsnft.com<ref name=":3" /><ref name=":4" /><ref name=":1" />.

Holders of Rare Bears were no strangers to phishing attacks. In fact, the Rare Bears Discord channel had recently been breached a month prior<ref name=":5">[https://cointelegraph.com/news/rare-bears-discord-phishing-attack-nabs-800k-in-nfts Rare Bears Discord phishing attack nabs $800K in NFTs - CoinTelegraph] (Jun 21, 2023)</ref><ref name=":6">[https://www.theblock.co/post/138250/hacker-steals-790000-of-nfts-and-crypto-from-owners-of-rare-bears Hacker steals $790,000 of NFTs and crypto from owners of Rare Bears - TheBlock] (Jun 21, 2023)</ref><ref name=":0">[https://mpost.io/rare-bears-nft-discord-hack/ Rare Bears NFT Discord Hack: Almost $800,000 Worth of NFTs Stolen - Metaverse Post] (Jun 21, 2023)</ref>, which was shortly after the project release. That breach was widely reported, with losses estimated to be between $790k and $800k.

== What Happened ==
The RareBears team posted an announcement about the attack on April 5th, 2022.
{| class="wikitable"
|+Key Event Timeline - Rare Bears Scam Account
!Date
!Event
!Description
|-
|March 12th, 2022 8:46:00 AM
|Rare Bears Launch
|The first Rare Bears NFT collection is released for minting<ref name="bearsraretwitter-10559" /><ref name="rarebearsnft-8507" />.
|-
|March 17th, 2022 11:21:05 PM MDT
|Previous Discord Breach
|An unrelated Discord breach happens, and is published on CoinTelegraph<ref name=":5" />, The Block<ref name=":6" />, and later Metaverse<ref name=":0" />. Users are reported to [[Rare Bears Discord Attack|lose over $800k worth of NFTs in this separate attack]].
|-
|April 4th, 2022 11:23:00 AM MDT
|Initial Post From EnoxxArt
|The Twitter phishing account EnoxxArt posts to announce the Rare Bears expansion plans<ref name=":2" />.
|-
|April 5th, 2022 12:43:00 AM
|Twitter Announcement
|The RareBears team posts their announcement on Twitter<ref name="bearsraretwitter-10405" />.
|-
|April 12th, 2022 4:45:00 PM MDT
|Hiring Social Media Outreach
|The RareBears ream announces the hiring of Shane, a lawyer from Singapore, to look after "Discord management/communications and social media outreach"<ref name="bearsraretwitter-10409" />.
|-
|April 16th, 2022 2:30:00 AM
|New Roadmap
|The RareBears team shares their new roadmap<ref name="bearsraretwitter-10407" /><ref name="bearsraretwitter-10408" />.
|-
|May 7th, 2022 10:00:00 AM
|Sentimental Post
|The RareBears Twitter posts "As a community, we've been through the ringer. We've gone through what could be any other project's worst nightmare. But we've risen to meet adversity and emerged on the other side stronger, more fired up, & with more conviction than ever! Don't bet against the bears."<ref name="bearsraretwitter-10406" />
|}

== Technical Details ==
The attack involved the registration and usage of a rarebears.org domain name and multiple fake Twitter accounts.

=== EnoxxArt Twitter Handle ===
EnoxxArt<ref name="bearsraretwitter-10405" /> is a misspelling of the EnoxArt Twitter handle which belongs to Enox, who created the Rare Bears NFT art.

The account posted several times<ref>[https://web.archive.org/web/*/https://twitter.com/enoxxart* EnoxxArt Twitter Posts - Internet Archive] (Dec 8, 2023)</ref>.

=== Valuable Domain Name ===
It appears that the attackers were successful due to the registration of a valuable and short rarebears.org<ref name="bearsraretwitter-10405" /> domain name. The Rare Bears website is actually located at rarebearsnft.com<ref name=":4" />. This website URL is only published through the project's linktree page<ref name=":4" />, which many users may not interact with.

=== The Final Post ===

== Total Amount Lost ==
At least $2k of losses were reported by Twitter user @lord_IY<ref name="lordiytwitter-10553" />:<blockquote>"[S]ad. 2k fallen victims already[.]"</blockquote>
The total amount lost has been estimated at $2,000 USD. 

== Immediate Reactions ==

=== Rare Bears Announcement on Twitter ===

The RareBears Twitter @BearsRare posted an announcement after some users started to fall for the scheme<ref name="bearsraretwitter-10405" />. <blockquote>"THIS IS A SCAM ACCOUNT!! Please report them and DO NOT click the links to their FAKE "presale". Only ever use our official links. Keep your wallets safe bears."</blockquote>

=== Community Reactions on Twitter ===
Twitter user @lord_IY called the situation "sad"<ref name="lordiytwitter-10553" />. Twitter user @PurplePopRocks had the idea that victims should be to blame and deserve their losses<ref name="purplepoprockztwitter-10410" />:<blockquote>"If [your] dumb followers fall for that again a month after mint they deserve to lose the money they already did once after mint for pure greed[.]"</blockquote>

== Ultimate Outcome ==
The RareBears team hired Shane specifically to help with their Discord management<ref name="bearsraretwitter-10409" />.<blockquote>"We are SO excited to have Shane @lunnietunesNFT as part of the Rare Bears team. He is a lawyer based in Singapore, with a background in law and communications. He looks after Discord management/communications and social media outreach. Let's all welcome him to the #BearFam!"</blockquote>The EnoxxArt account appears to have been suspended<ref>[https://twitter.com/enoxxart EnoxxArt Twitter Account (Suspended)] (Dec 8, 2023)</ref>.

== Total Amount Recovered ==
There does not appear to be any attempt to assist users who were affected in this case or any funds recovered in this case.

== Ongoing Developments ==
The RareBears team hired a new team member named Shane to help with their social media management on April 12th<ref name="bearsraretwitter-10409" />.<blockquote>"We are SO excited to have Shane @lunnietunesNFT as part of the Rare Bears team. He is a lawyer based in Singapore, with a background in law and communications. He looks after Discord management/communications and social media outreach. Let's all welcome him to the #BearFam!"</blockquote>The team also posted a new roadmap on April 16th<ref name="bearsraretwitter-10407" /><ref name="bearsraretwitter-10408" />:<blockquote>"We're coming back stronger than ever. If you haven't seen our Roadmap 2.0 here's a few highlights. new leadership. new utility & holder perks. utility token ecosystem. holders only merch. Factions. Mare Bears. We are excited!"</blockquote>They've also been posting encouragement to their community such as the following<ref name="bearsraretwitter-10406" />:<blockquote>"As a community, we've been through the ringer. We've gone through what could be any other project's worst nightmare. But we've risen to meet adversity and emerged on the other side stronger, more fired up, & with more conviction than ever! Don't bet against the bears."</blockquote>
==Individual Prevention Policies==
Users should be careful to ensure that all minting links come from the official team behind a project.

{{Prevention:Individual:Question Unrealistic Profit}}

{{Prevention:Individual:Double Check Transactions}}

{{Prevention:Individuals:End}}
==Platform Prevention Policies==
Exchange platforms can serve to validate that minting links are from the real source, and reduce the likelihood of successful phishing attacks.

{{Prevention:Platforms:Cryptocurrency Safety Quiz}}

A treasury can be set aside to assist victims with proven losses.

{{Prevention:Platforms:Establish Industry Insurance Fund}}

{{Prevention:Platforms:End}}
==Regulatory Prevention Policies==
{{Prevention:Regulators:Cryptocurrency Education Mandate}}

{{Prevention:Regulators:Establish Industry Insurance Fund}}

{{Prevention:Regulators:End}}
== References ==
<references>
<ref name="bearsraretwitter-10405">[https://twitter.com/BearsRare/status/1511233054404407296 Rare Bears - "THIS IS A SCAM ACCOUNT!! Please report them and DO NOT click the links to their FAKE "presale". Only ever use our official links. Keep your wallets safe bears" - Twitter] (Jan 29, 2023)</ref>
<ref name="bearsraretwitter-10406">[https://twitter.com/BearsRare/status/1522969513599283202 Rare Bears - "As a community, we've been through the ringer. We've gone through what could be any other project's worst nightmare. But we've risen to meet adversity and emerged on the other side stronger, more fired up, & with more conviction than ever! Don't bet against the bears" - Twitter] (Jan 29, 2023)</ref>
<ref name="bearsraretwitter-10407">[https://twitter.com/BearsRare/status/1518560460299137024 Rare Bears - "We're coming back stronger than ever. If you haven't seen our Roadmap 2.0 here's a few highlights. new leadership new utility & holder perks utility token ecosystem holders only merch Factions Mare Bears We are excited! Come join the #BearFam & our journey" - Twitter] (Jan 29, 2023)</ref>
<ref name="bearsraretwitter-10408">[https://twitter.com/BearsRare/status/1515246232792313862 Rare Bears - "We're beyond excited to release our new Roadmap! Get your #RareBears on OS now! To celebrate, we're giving away 2 Rare Bears NFTs." - Twitter] (Jan 29, 2023)</ref>
<ref name="bearsraretwitter-10409">[https://twitter.com/BearsRare/status/1514011788366401545 Rare Bears - "We are SO excited to have Shane @lunnietunesNFT as part of the Rare Bears team. He is a lawyer based in Singapore, with a background in law and communications. He looks after Discord management/communications and social media outreach. Let's all welcome him to the #BearFam!" - Twitter] (Jan 29, 2023)</ref>
<ref name="purplepoprockztwitter-10410">[https://twitter.com/PurplePopRockz/status/1511234032213798914 <nowiki>PurplePopRockz - "If [your] dumb followers fall for that again a month after mint they deserve to lose the money they already did once after mint for pure greed[.]" - Twitter</nowiki>] (Jan 29, 2023)</ref>
<ref name="rarebearsnft-8507">[https://rarebearsnft.com/ Rare Bears – Rare Bears NFT collection from digital artist, Enox Homepage] (Jul 14, 2022)</ref>
<ref name="opensea-8508">[https://opensea.io/collection/rarebearsnft-official Rare Bears NFT Collection - OpenSea] (Jul 14, 2022)</ref>
<ref name="opensea-10552">[https://opensea.io/assets/matic/0x2953399124f0cbb46d2cbacd8a89cf0599974963/56144700689644350180899240544937895920675956438542393869705654108823807328257 Matic Asset With Enox Information - OpenSea] (Feb 8, 2023)</ref>
<ref name="lordiytwitter-10553">[https://twitter.com/lord_IY/status/1511233419845505025 <nowiki>lord_IY - "[S]ad. 2k fallen victims already[.]" - Twitter</nowiki>] (Feb 8, 2023)</ref>
<ref name="bearsraretwitter-10559">[https://twitter.com/BearsRare/status/1502672262297944066 Rare Bears - "Our Pre-sale Mint is Live now! Take your time, you have 24 hours to mint. No need to rush anything! Don't mint from any links besides this link!" - Twitter] (Feb 13, 2023)</ref>
</references>