OpenSea Users Fell Victim to Phishing Attack, Losing Millions of Dollars Worth NFTs

^(Source)

Evening

So, worlds largest NFT marketplace OpenSea is investigating a phishing attack that resulted in hundreds of NFTs getting stolen. As per data compiled by the blockchain security service PeckShield over 254 NFTs were stolen, including Decentraland, Bored Ape Kennel Club
and Bored Ape Yacht Club NFTs.

The exact cost of all the stolen NFTs have not yet been ascertained, but the perpetrator have sold some NFTs worth $1.7 million of ETH so far. 32 users have been reported to lose their assets.

Devin Finzer, co-founder and CEO of OpenSea tweeted:

The smaller scale of the exploit backs the OpenSea claim that the hack is not connected to the platform and instead a phishing attempt that got successful.

Preliminary investigations revealed that the attacker exploited a flexibility on the Wyvern Protocol, the open source dex standard underlying most NFT smart contracts. The exploiter was able to get NFTs owners general authorization on a partial contract with many spaces left blank and once the hacker had the user signature he filled out the contract transferring NFTs ownership to their account without payment. Simply speaking hacker got the users to sign a blank check and once signed they filled out rest of the details.

The phishing attack happened at a meticulous timing, as on Friday OpenSea released a new smart contract asking their users to migrate to it. The victims may had received phishing emails posing to be official, asking them to sign a new contract that effectively resulted in them losing their assets.

Further investigations are underway, meanwhile OpenSea has urged their users to always use Official OpenSea website and to be on careful with fishy emails.