Moonbirds NFT founder Kevin Rose is the latest victim of a phishing attack that resulted in more than $2 million in losses. On Wednesday, the founder of the PROOF collective sent out tweets indicating that his personal wallet had been hacked. The total number of NFTs Kevin Rose lost is around 40, including 25 Chromie Squiggles and other rare collectibles. Read on for more on the incident below.
How did Kevin Rose lose $2 million on NFT?
Kevin Rose is said to have been “phished to sign a malicious signature that allowed the hacker to transfer a large number of high-value tokens.” – according to PROOF Vice President Arran Schlosberg. Rose signed an off-chain firm that created a list of all of his OpenSea-approved assets in one fell swoop. In the tweet announcing the hack, Kevin Rose warns his followers not to buy any Chromie Squiggles, a massive project from Art Blocks founder Snowfro.
Around 40 top NFTs are lost as a result of this hack. Some of these include expansive projects like Cool Cats, OnChainMonkeys, Chromie Squiggles, Autoglyphs, QQL Mint Pass, Admit One Pass, and more. Arran also claims that Kevin Rose was duped in a classic case of social engineering. Kevin Rose was tricked into a false sense of security and signed malicious transactions that were accepted by the OpenSea marketplace contract.
It also adds that PROOF’s collective digital assets are safe and unaffected by the hack. This is because PROOF NFTs require multiple approvals to access. The team claims that it is actively investigating the issue with the OpenSea and Ledger anti-fraud teams. Also, @cxcoda (TEST engineer) has submitted code to close access to the malicious website in Metamask. The closure will be effective globally within 24 hours.
What is going on with NFT cheats?
Kevin Rose is the latest in a series of phishing scams targeting major NFT/web3 developers. On January 7, Nike RTFKT COO Nikhil Gopalani lost around $137,000 worth of NFTs due to phishing attacks. NFT Twitter has been exploding with support and even rage against prominent scams in the industry. Top degen @Degentraland has called this the “saddest thing” they’ve seen to date.
Crypto detective @ZachXBT claims that the scammer also stole 75 ETH from another victim around the same time. The stolen funds are moved from there to FixedFloat, where the scammer exchanges their ETH for Bitcoin before depositing them into a bitcoin mixer. There are also reports that this is the same scammer who also stole a #6982 cyptopunk earlier this week.
Furthermore, crypto sleuth @0xQuit says that SeaPort approved the malicious off-chain signature. The SeaPort protocol allows builders to create powerful tools and offers more flexibility for merchants to buy and sell NFTs. This protocol powers OpenSea, but can be used anywhere. Exit says, “In essence, Seaport allows you to create a listing consisting of an asset or package of assets (offer items), along with the assets required to fulfill it (considerations).” Seaport scammers can sometimes try to reverse engineer this loophole to drain wallets that are still connected to the site. Quit advises that users should always vary from whatever account they use to interact with websites. More details on this type of wallet drain can be found at his twitter thread.
All investment/financial opinions expressed by NFTevening.com are not recommendations.
This article is educational material.
As always, do your own research before making any type of investment.
