OpenSea Users Fall Victim to Phishing Attack, NFTs Worth Millions Stolen

Over the weekend, the prominent NFT marketplace OpenSea was hit by a phishing attack leading to the loss of approximately 254 tokens — including Decentraland, Doodle, and Bored Ape Yacht Club NFTs — valued at over $1.7 million. A total of 32 users have been identified to be victims of the recent attack.

It is believed that the attackers took advantage of the marketplace’s planned smart contract migration in an effort to guarantee that old, inactive listings on the platform would eventually expire.  Others have suggested that the attack may have originated from OpenSea’s own website, granted that it was in the process of issuing new contracts the day before. “I checked every transaction,” elaborated a user known as Neso. “They all have valid signatures from the people who lost NFTs so anyone claiming they didn’t get phished but lost NFTs is sadly wrong.”

“We are actively investigating rumors of an exploit associated with OpenSea related smart contracts,” explained OpenSea. “This appears to be a phishing attack originating outside of OpenSea’s website. Do not click links outside of opensea.io.” Devin Finzer, the CEO of OpenSea, noted that the targets signed a partial contract — similar to signing a blank check — that allowed the attackers to transfer ownership of the NFTs under the possession of their victims.

“We are not aware of any recent phishing emails that have been sent to users, but at this time we do not know which website was tricking users into maliciously signing messages,” tweeted Finzer following the attack. “Always double check that you are interacting with https://opensea.io in your browser when you sign messages.”

“We’ll keep you updated as we learn more about the exact nature of the phishing attack,” he assured OpenSea users. “If you have specific information that could be useful, please DM @opensea_support.”

Sources: The Verge, CoinDesk