Crypto Prices
    NFT News

    “Opensea Vulnerability Incident” Leads to the Theft of a Large Number of NFTs

    By
    “Opensea Vulnerability Incident” Leads to the Theft of a Large Number of NFTs

    On the morning of February 20, the issue of “suspected bugs in OpenSea’s new migration contract led to the theft of a large number of high-value NFTs” aroused heated discussions.

    According to multiple Twitter KOLs, the incident was caused by a suspected bug in the new migration contract (address: 0xa2c0946aD444DCCf990394C5cBe019a858A945bD) launched by OpenSea yesterday. BAYC, BAKC, MAYC, Azuki, Cool Cats, Doodles, Mfers and many other high value series.

    Twitter KOL “Jon_HQ” tweeted that the attacker spent a total of $750 in gas fees, did not pay for ETH purchases, but got 4 Azukis, 2 Coolmans, 2 Doodles, 2 KaijuKings, 1 MAYC, 1 Cool Cat, 1 BAYC…

    OpenSea users have lost more than $20 billion

    Mr. Whale also said on Twitter that Opensea “exploit” can allow users to sell and steal any NFT from any user, and the loss has exceeded 200 million US dollars.

    Related:  Jury Rules in Favor of Hermes in NFT Trademark Infringement Case

    The new migration contract is a new upgrade released by OpenSea. Yesterday, OpenSea announced that its smart contract upgrade has been completed, and the new smart contract has been launched. Users need to sign a pending order migration request to migrate smart contracts. Signing this request does not require gas fees, and there is no need to re-apply for NFT or initialize wallets. During the migration, the quotes on the old smart contracts will be invalid. British auctions will be temporarily disabled for a few hours after the contract upgrade is completed, and new timed auctions can be created again after the new contract takes effect. The Dutch auction of existing smart contracts will expire at the end of the migration period at 3:00 GMT on February 26th.

    Subsequently, gmDAO founder Cyphr.ETH tweeted that the hackers used standard phishing emails to copy “genuine OpenSea” emails that occurred a few days earlier, and then asked some users to sign permissions using WyvernExchange. There is no vulnerability in OpenSea, it’s just that people don’t have permission to read signatures as usual.

    Security firm PeckShield also said that, although unconfirmed, the Opensea hack was likely phishing. Users follow the instructions in the phishing email to authorize “migration,” which unfortunately allows hackers to steal valuable NFTs.

    Foobar, a developer of the Ethereum smart contract programming language Solidity, analyzed that the hacker used a helper contract deployed 30 days ago to call an operating system contract deployed 4 years ago, using valid atomicMatch() data. This could be a typical phishing attack from a few weeks ago. Instead of a smart contract vulnerability, the code is safe.

    OpenSea officials have launched an investigation into the matter

    So far, OpenSea officials have launched an investigation into the matter, and responded with a tweet saying:

    “We are actively investigating rumors of an exploit associated with OpenSea related smart contracts. This appears to be a phishing attack originating outside of OpenSea’s website. Do not click links outside of http://opensea.io.”

    According to a number of Twitter KOLs and official statements, the security incident was probably caused by an external phishing attack. But there are also some different voices.

    OracleHawk CEO Jacob King tweeted a screenshot of the code and thought: “OpenSea is now lying and claiming that the vulnerability is really just a phishing email people get.”

    What is the final cause of this vulnerability incident, we still need to wait for the results of OpenSea’s investigation.

    DISCLAIMER: The information provided by WebsCrypto does not represent any investment suggestion. The articles published on this site only represent personal opinions and have nothing to do with the official position of WebsCrypto.
    Related News