Hackers Stole $1.7 Million Worth of NFTs from Users of OpenSea Marketplace

Destructive actors took gain of a sensible contract update course of action in the OpenSea NFT marketplace to have out a phishing assault from 17 of its people that resulted in the theft of virtual property worthy of about $1.7 million.

NFTs, brief for non-fungible tokens, are electronic tokens that act like certificates of authenticity for, and in some instances depict possession of, belongings that selection from costly illustrations to collectibles and physical goods.

The opportunistic social engineering rip-off swindled the users by using the exact same e-mail from OpenSea notifying users about the update, with the copycat e-mail redirecting the victims to a lookalike webpage, prompting them to indication a seemingly legit transaction, only to steal all the NFTs in one particular go.

“By signing the transaction, an atomicMatch_ ask for would be sent to the attacker deal,” Check Level researchers described. “From there, the atomicMatch_ would be forwarded to the OpenSea contract,” foremost to the transfer of the NFTs from the target to the attacker.

OpenSea’s “Wyvern” wise deal migration, which commenced on February 18 above a 7-working day interval right up until February 25 at 2:00 PM ET, is part of the New York City-primarily based firm’s efforts to address aged, current inactive listings on the Ethereum blockchain.

The organization said it is nevertheless investigating the correct resource of the assault, noting that the malicious orders experienced been signed by the victims prior to OpenSea carried out its migration. “The assault no longer appears to be to be lively, but we are continuing to keep an eye on. We have not found action from the attacker’s wallet in >36 several hours,” OpenSea mentioned in an update.

“Signing a transaction is comparable to providing a person authorization to accessibility all your NFT’s and cryptocurrencies,” Check Issue said. “This is why signing is incredibly dangerous. Pay out additional attention to exactly where and when you sign a transaction.”

The improvement also arrives as cybercriminals are exploiting the progress in reputation of NFTs to trick victims into downloading the BitRAT remote obtain trojan malware that’s able of thieving browser credentials, mining cryptocurrency, and harvesting sensitive information and facts.