{"id":602,"date":"2022-03-05T13:53:28","date_gmt":"2022-03-05T13:53:28","guid":{"rendered":"https:\/\/grandpascrypto.com\/?p=602"},"modified":"2022-03-09T01:33:41","modified_gmt":"2022-03-09T01:33:41","slug":"opensea-phishing-attack","status":"publish","type":"post","link":"https:\/\/grandpascrypto.com\/opensea-phishing-attack\/","title":{"rendered":"OpenSea Phishing Attack"},"content":{"rendered":"\n

tl;dr Summary:<\/em><\/strong> OpenSea was recently the victim of a phishing attack which compromised $1.7 million of NFT assets. How did this happen?<\/em><\/em><\/p>\n\n\n\n

At the core of all blockchain technology is the promise of transparent, immutable, and unhackable data storage. This promise has attracted millions of web developers, computer programmers and creators alike to explore the capabilities of the blockchain. However, the congregation of users actively participating on Web3 platforms where billions of dollars in value are exchanged daily in the form of cryptocurrency and NFT assets has also attracted many bad actors. In 2021, there were over 20 incidents where a hacker had stolen more than $10 million in value<\/a> from a cryptocurrency exchange or project. While these attacks are rare compared to the 1.25 million transactions<\/a> occurring daily on Ethereum, they inflict financial distress and mental anguish to those affected and leave the crypto community at large feeling demoralized.\u00a0<\/p>\n\n\n\n

The latest of these attacks occurred on February 19, 2022 when prominent NFT marketplace OpenSea reported on Twitter<\/a> that there were rumors of an exploit on their platform. Initial indications suggested that the exploit was a phishing attack, which is the practice of sending fraudulent communications that appear to come from a reputable source with the goal of acquiring a user\u2019s sensitive information. The attack ultimately drained 16 wallets of all NFTs and cryptocurrency in their wallet, amounting to over $1.7 million in value<\/a>.<\/p>\n\n\n\n

How did this happen?<\/strong><\/p>\n\n\n\n

Several weeks before the phishing attack, a bug<\/a> (or error in the source code) was detected on the OpenSea smart contract which allowed a hacker to purchase popular NFTs at previously listed prices. Because of this exploit, one user accidentally sold a Bored Ape Yacht Club NFT for 4.7 ETH (~$12k). The lowest price, or floor price, for the same NFT collection is currently at 88.8 ETH (~$250k). The hacker was able to sell a total of 332 ETH worth of NFTs (~$875k).<\/p>\n\n\n\n

In order to resolve this exploit, OpenSea reimbursed<\/a> the affected users and immediately started working on changes to their smart contract (the source code which runs the platform) to resolve the bug. The new OpenSea smart contract would cause all old and inactive listings to eventually expire. It was set to take effect on Friday, February 25th<\/sup>. OpenSea had sent users an email informing them that this smart contract migration was occurring and offered instructions on how to migrate their NFT listings to the new smart contract. The hacker responsible for the phishing attack had sent users an email that appeared identical to OpenSea\u2019s initial email. However, the hacker\u2019s email contained a link which caused users to inadvertently authorize the sale of the NFT\u2019s in their wallet for 0 ETH. The attacker achieved this by prompting users to sign half of an empty order from Wyvern Exchange, a digital asset exchange protocol running on Ethereum. The order contained minimal information except for the hacker\u2019s address and call data, unintelligible to the common user. The attacker then signed the other half of the order, in essence writing a blank check to themselves and giving them full control of the victim\u2019s wallet.<\/p>\n\n\n\n

Albeit a devastating blow to OpenSea\u2019s reputation and overall trust of the blockchain, this incident does have some redeeming aspects. Due to the transparency of the blockchain, investigators were able to quickly discover the wallet address of the hacker where the stolen assets were sent and all subsequent transactions made by that wallet. Even though the owner of the wallet address is anonymous, OpenSea was able to blacklist the wallet and blocked the attack from spreading further. The victims also have direct evidence on the blockchain of which assets were stolen, making the process for reimbursement far easier for all parties involved. Traditional scams like phone scams are far more common than Web3 scams and much more difficult to trace. Americans reported losses of nearly $30 billion<\/a> to telescams in 2021. In the majority of cases, the victims and authorities are unable to locate the stolen funds or the perpetrators.<\/p>\n\n\n\n

Could this happen again?<\/strong><\/p>\n\n\n\n

Illegal activity online has become an inevitability in our lives. As long as there is monetary value to be stolen and people to be exploited, hackers and scammers will continue to find new ways to do so. Web3 projects like OpenSea are no different as they have to share applications and services with Web2 like email domain servers and internet browsers.<\/p>\n\n\n\n

It is still unknown how the hacker was able to obtain OpenSea users\u2019 email addresses. The OpenSea smart contract stored on the ethereum blockchain was not hacked, but it is possible that components on the OpenSea webpage, their email server or third parties handling various elements of their platform were compromised. At this time all potential causes are speculation, however, it has become evident that social engineering<\/a> has been at the root of the majority of hacks and scams in the Web3 space. <\/p>\n\n\n\n

A social engineering scam is when a scammer uses manipulative tactics and deceit to convince unsuspecting users to reveal their sensitive information. Some examples of social engineering scams are fake giveaways, romance scams and phishing attacks. Scammers use techniques such as impersonating reputable sources and creating a false sense of urgency or fear to fool people into giving up vital information needed to access their crypto wallets or exchange accounts. In order to avoid falling victim to a hack like OpenSea\u2019s phishing attack it is important to stay informed, avoid clicking on any email links from a person or company you do not recognize and always carefully read wallet transactions before authorizing.<\/p>\n\n\n\n

Here are some WhiteboardCrypto videos about how to avoid scams:<\/p>\n\n\n\n

Crypto Scams to Avoid – 10 Tricks Scammers Use<\/a><\/p>\n\n\n\n

Avoid Crypto Scams – 7 Signs of a Rug Pull!<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

OpenSea was recently the victim of a phishing attack which compromised $1.7 million of NFT assets. How did this happen?<\/p>\n","protected":false},"author":2,"featured_media":613,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[56],"tags":[68,110,118,122,198,200,199],"yoast_head":"\n\n\n\n\n\n\n\n\n\n\n\n\t\n\t\n\t\n\n\n\t\n\t\n\t\n