OpenSea Narrows Down List of Impacted Users, Still Looking for the Cause

 

Major NFT marketplace OpenSea, which said it fell victim to a phishing attack over the weekend, has narrowed down the list of impacted individuals from the initial assumption of 32 to 17. However, the platform said it still hasn’t determined the exact source of the issue.

“Our original count included anyone who had *interacted* with the attacker, rather than those who were victims of the phishing attack,” the company said on Monday morning (UTC time).  They also noted that the “attack does not appear to be active at this time” and  “there has been no activity on the malicious contract in >15 hours.”

On Saturday, a slew of panicked NFT traders started reporting the loss of their digital assets, including NFTs from popular collections like Cool Cats and Doodle. 

Back then, OpenSea said that this “appears to be a phishing attack” originating outside of their website.

OpenSea CEO Devin Finzer added that victims might have “signed a malicious payload from an attacker.” The platform also claimed that “the attack does not appear to be email-based.”

However, not everyone was convinced that it was a phishing attack. 

How the fuck is this a phishing attack that isn’t email-based? Stop trickling information out & tell us what material facts have led you to declare this to be a “phishing attack”.

There are already millions gone. You do no one any favors by concealing details. https://t.co/5Ye05umYu7

— James Edwards (@librehash) February 21, 2022

Connecting the wallet to a site doesn't endanger your wallet.

Sounds like you approved a malicious contract that drained your wallet.

— τ (@kavourias) February 21, 2022

Nadav Hollander, Chief Technology Officer of OpenSea, has also argued that impacted users should have approved a malicious contract. “All of the malicious orders contain valid signatures from the affected users, indicating that they did sign an order somewhere, at some point in time,” he said.

On Friday, OpenSea released a smart contract update that requires all users to move their listings on Ethereum (ETH) to the new smart contract. 

While some argued that the issue might have been with the migration, Hollander said that the malicious orders “were signed before the migration and are unlikely to be related to OpenSea’s migration flow.”

In either case, according to Ryan Selkis, Founder & CEO of crypto analysis firm Messari, OpenSea users learned a valuable lesson about self-custody and digital signatures. 

“One that will be helpful if they ever need to secure digital assets and exit a hostile country,” Selkis said, adding that for those in crypto, self-reliance is integral to the products they use, and they are “rewarded for risks with higher upside.”

Meanwhile, as reported, in late January 2022, OpenSea experienced an issue related to user interface (UI) design, which allowed some of its users to buy NFTs at much lower prices. 
____
Learn more: 
– Crypto Security in 2022: Prepare for More DeFi Hacks, Exchange Outages, and Noob Mistakes 
– OpenSea Boosts Valuation 9X as This NFT Giant Sets Four Strategic Goals

– NFT Market Cools Down Once Again as Crypto Prices Heat Up
– Removing LooksRare’s USD 8.3B in Wash-Trades, OpenSea is Still the Dominant NFT Marketplace