On Saturday, a hacker launched a phishing attack to gain potentially hundreds of NFTs from users of OpenSea, one of the world’s largest NFT marketplaces, with a value of $1.7 million. Company officials on Sunday sought to calm customers by assuring them that it was safe to trade NFTs on OpenSea while an investigation was ongoing.
After the incident, Devin Finzer, CEO OpenSea, stated that a hacker of tricking almost three dozen individuals into unwittingly signing a harmful payload that authorized the transfer of their NFTs to the attacker for free. Finzer stated that the firm was confident that this was a phishing attack, but they didn’t know where the scam originated from. The assault is presently thought to have originated from outside OpenSea, according to the organization.
OpenSea hacked: Users lost $1.7 million
OpenSea’s migration to its new Wyvern smart contract system, which started on Friday and is scheduled to be completed by February 25. Hackers took advantage of the migration and attacked during the process.
On Twitter, Finzer stated that the assault did not originate from OpenSea’s website. He also said interacting with an email from OpenSea was not a source of the phishing attack and that none of the victims reported clicking on links received in unsolicited emails. Also, the site’s banner, signing the new Wyvern smart contract, and using OpenSea’s listing migration tool to migrate listings to the new Wyvern system were all deemed safe.
This attack did not originate on https://t.co/TYuT1WACso.
— Devin Finzer (dfinzer.eth) (@dfinzer) February 20, 2022
Finzer stated that:
“We’re actively working with users whose items were stolen to narrow down a set of common websites that they interacted with that might have been responsible for the malicious signatures. We’ll keep you updated as we learn more about the exact nature of the phishing attack.”
On Sunday, Nadav Hollander of OpenSea, the firm’s CTO, outlined the assault in a technical manner. The hacker was able to obtain possession of the victim’s money by impersonated as a reputable investment firm, according to Hollander. The attack was not linked to the transition to the new Wyvern contract system and that the victims of the attack signed off on the orders beforehand.
1) Sharing a technical run-down of the phishing attacks targeting @OpenSea users, including some web3 technical education.
👇— Nadav Hollander (@NadavAHollander) February 20, 2022
The attack, which took place on Saturday over the course of several hours, appears to have been targeted.
Hollander stated:
“32 users had NFTs stolen over a relatively short time period. This is extremely unfortunate, but suggests a targeted attack as opposed to a systemic issue”
Although the assault appears to have taken place outside of OpenSea, the firm is currently assisting victims and discussing methods to supply them further support.
