OpenSea, one of the largest NFT marketplace, is probing a phishing attack that seems to be no longer active. Devin Finzer, the company’s CEO, doesn’t believe it’s connected to the OpenSea website.
Finzer highlighted that 32 users have signed a malicious payload from an attacker. They reported some NFTs were stolen and some have been returned. He brushed off rumors that the hack was worth $200 million. However, Finzer confirmed that the hacker has $1.7 million of Ether in his wallet from selling the stolen NFTs.
He said it is a phishing attack but the platform doesn’t know where it occurred. Finzer pointed out that the attack didn’t come from OpenSea’s domain and no legitimate OpenSea emails, nor the platform’s site banner led to the attack.
The malicious wallet labeled Fake Phishing5169 made its first move in December but reports of the phishing activity only emerged yesterday. OpenSea says this wallet is connected with another wallet. It has been marked as part of an OpenSea phishing scam.
A number of NFTs, in the past 24-hours, from renowned collections such as Bored Ape Yacht Club, Doodles, Cool Cats and Azuki NFTs have been transferred. Moreover, the malicious wallet has made transfers through Rarible and LooksRare.
Finzer highlighted that trading, minting or listing items using OpenSea.io is not a vector for the attack, and neither is signing the smart new contract – Wyvern 2.3. He also said that the platform’s listing migration tool was not involved in the attack. OpenSea is working with users whose items were stolen to zero on the common websites that they interacted with and may be responsible for the malicious signatures.
