Non-fungible tokens (NFTs) were stolen from the users of OpenSea, an online NFT marketplace on February 19. This sparked rumours that the NFT marketplace was hacked. But the online NFT market team denied rumours and declared the incident as a phishing attack.
Last week, OpenSea had announced an upgrade wherein users were required to migrate their NFTs from the Ethereum (ETH) blockchain to a new contract.
Following the announcement users started getting phishing emails that authorised “migration”. Hackers started sending fraudulent emails to the OpenSea NFT holders, under the pretext that the emails and the fake webpage therein were the gateways for the users to get their NFTs listed on the new smart contract.
The process, once authorised, paved the way for hacker to steal NFTs. This was explained by PeckShield, a blockchain security company in a series of tweets.
According to the deep dive investigation done by the OpenSea team it was found out that around 32 users so far signed a malicious payload from an attacker, and that’s how some of their NFTs were stolen.
Devin Finzer, chairman and CEO of OpenSea, while clearing all rumours stated, “This is a phishing attack. We don’t believe it’s connected to the OpenSea website.”
After having sold some of the NFTs, the attacker's wallet held more than 600 Ethereum worth about $1.7 million of stolen NFTs, Finzer mentioned in a tweet.
The OpenSea team has been working with users whose data has been stolen to narrow down a set of common websites that they interacted with that might have been responsible for the malicious signatures.
Also Read: Realme to unveil its fastest charger yet at MWC 2022: Here’s what we know
Also Read: Samsung S22 series pre-booking to go live at 6pm today