The official Discord channel of the NFT (opens in new tab) marketplace OpenSea (opens in new tab) was recently infiltrated by cybercriminals who used it to distribute a phishing link.
According to The Verge (opens in new tab), a bot in the channel made a fake announcement that the NFT marketplace was partnering with YouTube and that users should click on a “YouTube Genesis Mint Pass” in order to get one of 100 free NFTs before they’re gone forever.
(opens in new tab)Just like cybercriminals often do in phishing emails (opens in new tab), this message instilled a sense of urgency (opens in new tab) to get users to click on a link to a site that that blockchain security company PeckShield has now flagged as a phishing site.
At the same time, as the NFT space tends to move rather quickly, users knew from past experience that they only had a limited time to claim one of the free NFTs and likely didn’t want to miss out.
Stolen NFTs
Although the malicious messages have been removed from OpenSea’s Discord channel and the phishing site has also been taken down, one user said they lost NFTs in the incident and pointed to an address on the blockchain (opens in new tab) that belonged to the cybercriminals responsible.
Viewing the address on Etherscan.io or on competing NFT marketplace Rarible (opens in new tab) shows that 13 NFTs were actually transferred to it from five users around the time of the attack and based on their prices when last sold, all five NFTs appear to be worth just over $18k.
While OpenSea hasn’t yet explained how its Discord channel was hacked, one possible explanation is that the cybercriminals leveraged the webhook functionality (opens in new tab) that organizations utilize to control bots which make posts on their channels.
> That NFT job offer is probably malware (opens in new tab)
> Another top NFT marketplace may have a serious security flaw
(opens in new tab)
> Several huge NFT Discords hacked by scam attacks (opens in new tab)
In a statement to The Verge, OpenSea spokesperson Allie Mack provided further details on how the company responded to the incident, saying:
“Last night, an attacker was able to post malicious links in several of our Discord channels. We noticed the malicious links soon after they were posted and took immediate steps to remedy the situation, including removing the malicious bots and accounts. We also alerted our community via our Twitter support channel to not click any links in our Discord. Our preliminary analysis indicates that the attack had limited impact. We are currently aware of fewer than 10 impacted wallets and stolen items amounting to less than 10 ETH.”
Whether you’re on Discord (opens in new tab) or Telegram (opens in new tab), you should avoid clicking on suspicious links especially in messages that try to instill a sense of urgency to prevent falling victim to phishing attacks.
- Get an alert when your data ends up on the dark web with the best identity theft protection (opens in new tab)
Via The Verge (opens in new tab)
