The world’s largest NFT exchange, OpenSea confirmed that some of its users have been hit by a phishing attack and had lost valuable NFTs worth $1.7 million.
Co-Founder and CEO of OpenSea, Devin Finzer has confirmed the phishing attack and he also added that 32 users have lost NFTs.
The analysis of the attacker’s wallet revealed it contained $1.7 million of ETH (Ethereum) obtained by selling some of the stolen NFTs. Finzer pointed out that the company doesn’t believe the hack is connected to the OpenSea website.
Motherboard reported that blockchain records show that the attacker was able to transfer numerous NFTs from different users to their address for free. Stolen NFTs included examples from the Bored Ape Yacht Club, Mutant Ape Yacht Club, and several other popular collections. The attacker has already sold some of the NFTs. The attacker’s wallet currently contains more than 600 ETH worth nearly $2 million.
According to the Blockchain security firm Peckshield the threat actors behind the OpenSea hack used TornadoCash fully decentralized protocol for private transactions on Ethereum to wash 1,100 ETH (approximately $2.7 million)
PeckShield stated that threat actors may have launched a phishing campaign using the migration process as bait.
OpenSea is investigating rumors of an exploit associated with OpenSea related smart contracts that may have been exploited by attackers.
The attack was linked to the announcement of the marketplace of a new smart contract upgrade with a one-week deadline aimed at delisting inactive NFTs on the platform.
In order to upgrade the smart contract, users have to migrate their listed NFTs from ETH blockchain to a new smart contract.
The impacted users started reporting suspicious activities within hours after the upgrade announcement. All the impacted users are requested to contact Finzer via Twitter DM.
Image Credits : NewsBTC
Comments