Image: Getty Images
A hacker or hackers are actively stealing and flipping high-valued NFTs from users on OpenSea, the world’s largest NFT exchange, causing chaos and confusion in the broader NFT community. The current mechanism for the hack is currently unknown, but OpenSea placed a red banner at the top of its site Saturday night saying “We are actively investigating rumors of an exploit associated with OpenSea related smart contracts. This appears to be a phishing attack originating outside of OpenSea's website. Do not click links outside of opensea.io.” OpenSea is currently requiring users who list NFTs on the site to upgrade to a new smart contract that fixes an issue with inactive listings that was allowing scammers to swipe valuable NFTs from collectors on OpenSea for dirt cheap; some high profile NFT users are speculating now that a malicious actor is phishing people with a fake page designed to look like the one used to upgrade to that contract.OpenSea did not immediately respond to a request for comment. A discussion about the hacks on Twitter Spaces had more than 3,700 listeners Saturday night. Blockchain records show that the attacker was able to transfer numerous NFTs from different users to their address for free. Stolen NFTs included examples from the Bored Ape Yacht Club, Mutant Ape Yacht Club, and several other popular collections. The attacker has already sold some of the NFTs, for example, this NFT from the Azuki collection for 13.4 ETH ($36,380). The attacker's wallet currently contains more than 600 ETH worth nearly $2 million.
There are indications that the hacker is giving some of their ill-gotten goods back. In one instance, the hacker stole numerous NFTs from one user including one valuable BAYC NFT. The hacker returned all the NFTs except the BAYC, which is currently frozen on OpenSea. The attacker's page on the marketplace similarly 404s. Security researcher Dan Guido tweeted Saturday night that “the security of web3 platforms depend entirely on wallets with universally poor security UX, and there’s very little the platforms can do about it,” adding that, "in a strange win for transparency," it's currently possible to see which NFTs have been stolen.
Subscribe to our cybersecurity podcast, CYBER. Subscribe to our new Twitch channel.
There are indications that the hacker is giving some of their ill-gotten goods back. In one instance, the hacker stole numerous NFTs from one user including one valuable BAYC NFT. The hacker returned all the NFTs except the BAYC, which is currently frozen on OpenSea. The attacker's page on the marketplace similarly 404s. Security researcher Dan Guido tweeted Saturday night that “the security of web3 platforms depend entirely on wallets with universally poor security UX, and there’s very little the platforms can do about it,” adding that, "in a strange win for transparency," it's currently possible to see which NFTs have been stolen.
Subscribe to our cybersecurity podcast, CYBER. Subscribe to our new Twitch channel.