Scammers Phish Out Millions of Dollars in NFTs from OpenSea Users
A couple of days ago, security researchers with Check Point published a blog post detailing a phishing attack that targeted OpenSea users and led to what researchers estimate as "millions" in stolen NFTs.
OpenSea advertises itself as the "largest NFT marketplace", offering a P2P marketplace for exchanging non-fungible tokens or NFTs. The platform was going through an update process that required contract migration. The goal of this was to take care of inactive listings of old tokens, which in turn requires the users to take action so their contracts can be upgraded.
Phishing for NFTs
The OpenSea team sent out a detailed guide to users, explaining how exactly they should handle the procedure and migrate their NFT listings. However, a threat actor caught wind of this and decided to abuse the situation.
The scammers sent out phishing emails, doctored to look like the official correspondence sent out by OpenSea. The body of the message copies the original text used by the legitimate OpenSea messages. However, the scammers link to a phishing page instead. Once on that page, the victim is urged to sign a transaction form, once again tailored and doctored to look almost exactly the same as the official OpenSea one. However, the scammer page instructs users to plug in their ledger device, select the Ethereum app, then enable "smart contract data" and "blind signing". This text is missing in the original message from the NFT platform.
Once the victim signs the transaction offered, they send a request to the attacker's contract, which has been created roughly a month before the phishing attack. The request itself is called atomicMatch_ and is used in trades on the NFT platform. Check Point explained that "atomic" refers to the fact that the transaction will be effected only if all parameters are met.
The account used to steal the NFTs appears to have bubbled with a fresh $2 million worth of stolen and resold NFTs, according to the research team.
The Rush for Non-Fungibles
NFTs have become a very hot topic in recent months, to the point where not just content creators and brands are interested in them, but even huge entertainment and gaming companies have started driving hard towards implementing them on a regular basis. The topic is controversial and while many crypto fans embrace NFTs, a lot of others think NFTs are essentially a very elaborate way to convince people to part with their money.
This latest accident only goes to show that, similar to crypto marketplaces and exchanges, NFT marketplaces will also be targeted by threat actors and will show up in the news, as the more this sort of infrastructure and userbase grows, the larger the attack surface that will be available to threat actors as well.
