OPENSEA NFT HACK - what you should know? - podcast

Details behind OpenSea hack. What is known so far…

Hello everyone, so breaking news there is seems some open hack which which is shaking crypto markets right now. And yeah let's just go through the overview and what is known at this moment. So open props and phishing attack co-founder says so. The co-founder of open seats at that non fungible. Marketplace is investigated and efficient attack with Jason appeared to be active and the main statement from Diving Finder is like we don't believe it's connected to the Open Sea website. Diamond fencer who is also chief executive officer, said on Twitter is appears 32 users thus far have signed a malicious payload from attacker, and some of their efforts were stolen. So basically you can see right now if you just go to Twitter like open C is trending in United States, 571 K tweets about this topic. Yeah, and that's basically people are super concerned. Ethereum price went down. It's it's a big big shake up for like all the crypto market because obviously if the most if the biggest NFT marketplace and marketplaces biggest reputation can be just hacked by like you know some hacker. It sends all the security of basically Ethereum and crypto like under question like. Can you really store money there? But I think it's still part of the, you know, just volatility process and it doesn't seem to be that huge and I still. Still saying that you know, crypto assets seem to be the future, but it's just part of the growing process. Of course it will be like up and downs, but let's just see how that's working so you can follow ISO tile on Twitter. He just explained what exactly happened and what open CNMT hack was about. So 28 days ago the hacker applauds a new smart contract he already knows well that his goal is to get as many signatures as possible. And you can easily track. This contract on Interscan, that's the beauty of blockchain that everything is transparent and you can basically see the hackers actions and all of that so you can see 28 days 15 hours it goes. There is a contract creation and then basically the whole hack is about just sending phishing emails with phishing websites and then they tell you to sign a message to login migrate using new open smart contract instead you are assigning a private sale. Of your NFT to the hacker. So basically, if you just received some weird phishing email. From open sea or like you know. Some signature request in mail. It just never clicked that like that's a big security concern for all the Ethereum and blockchains that just one click. And Justice one sign and confirmation from your meter was qualities like literally can't be enough just to install all your MFT. So just never do that. It's super dangerous, you know. In Web two world you already you have a lot of phishing emails which can ask your credit card accounts or something like that where you need to sign some loan or something. But that sometimes requires that you really enter your credit card details like start the payment and it's more complicated. You need to really browse the website, make like few clicks and all that here. 1-2 clicks, and that's that's enough. That's done because that's the the you know, the nature of the blockchain, but everything is actually much faster. You don't need any ID verification, nothing, you can just confirm some transactions with mathematic and that's it. And then you don't own your anymore. So yeah, then just let's continue the exploration and then today this hacker executes the smart contract function to steal the NFTS before the listing is expired. And then he can actually do that because he has signatures. Start on his server as a final note, always check what you are signing because one click makes a difference. You can revoke access your from official website. And then yeah, you can just see that. Some people say like almost 3K words robbed. Uhm? So that's that. And so therefore, like a lot of people writing and Twitter, that at that moment we are just staying away from buying, selling and open right now. Uhm? Whole wallet got hacked avax Ethereum like Binance. Everything stolen last week. So that's that's what it is like 1. Explanation is that. Yeah, some people a lot of concerned about like open security going further. So it's just creates a lot of questions. Is it really? So dairy Howard. People are writing open. See still alive bro. Of course, like. OK, let's just go through that through that like Twitter thread by Open SQL founder. What he says Devin. FTR, I know you are all work. We are running an all hands on deck investigation, but I want to make a minute to share the facts as I see them. As far as we can tell, this is efficient attack. We don't believe it's connected. Open website. Your search users so far have signed a malicious pilot from an attacker, and some of their efforts were stolen. The attack doesn't appear to be active at this point. We haven't seen any malicious activity from the attackers account in two hours. Some of them have been returned. We are not aware of any recent phishing emails that have been sent to user, but at this time we don't know which website was treating users or rules. Double check that you're interacting with open CIO in your browser. When you sign a messages. If you are affected user, you can DM opensees support so that we can sort of the investigate for more technical construct. Text you can read another feature thread. If you're concerned, I want to protect yourself, you can unapproved access to your NFT collection. Rumors that this was a 200,000,000 hack are false. The attacker has 1.7 million of material. Yep, so. Very hard, so that's that's basically it. Of course, like people are a bit in disbelief like what really happened. You were still investigation ongoing, and this bridge is trust in open C, but I hope everything will play out OK, and these issues are just part of the growth of this kind of platforms. And I hope everything will workout is just part of every new technology. Just to explore this all new. You know it won't be easy, but as I understand still it was phishing attack. It wasn't like you know, some major hack on open website where just whole open was hacked like it would be a really a disaster. But still at my view still blockchain proves that it's pretty secure. Yeah, because. You don't like it opens the exist for like 3 plus years I guess and there wasn't like still a major hack which someone would stall. Like you know hundreds of 1,000,000 worth of assets. If that happens, then yeah, that's pretty serious, but so far you can see that. Yeah, of course there is some hackers who basically email a lot of people some phishing emails, but that's basically it, just don't. Leak any links about blockchain crypto and about signing some contracts with your wallet. Just never do that. Seems it's becoming a major issue because again it's like so easy just to. To install your NFTS and your money just with a single Click to confirm some transaction. So. Some other people say it's likely it's a signature phishing attack from somewhere of big spikes that attackers exploiting now before all listings expire. Some other a run. I connected with a few other people who got hacked just now. All of us only have one thing in common. All of our stolen were once you manually migrated, an open seat opens. You have so much explaining to do now. Here is a contract interaction. A lot of. People asking me if I got finished. I did receive an email from Opensees that contained a link. That in my links to email dot open C dot IO and it's mail server signature is. CR certified 69 or that open seat I did any receive any other email from them today? Hope that helps. Here is a trace of that exact link. I didn't click the link, the email prompted me to go check out offensive, so I went from the header at the top of open sea. Some people say shame, broken, see do better. Come. After scan IO is down. And there are a lot of explanations here. Opens the exploit everyone tag opens it together and post our new contract. Just want to show that there is potential that this exploit could have originated from phishing email. Either way, educate yourself. Uh. You can go to revoke cash and immediately revoke the approvals to that new contract. This exploit looks like to be getting hit really hard right now, so this is urgent revoke cash. So. Do you like deposit 1.1 etherium into water and two minutes later it was transferred out to another world at thanks, open, see, do you have a Ledger? Just start to silent. And some people said no, I don't have a hardware wallet, so yeah for sure, just try to use hardware wallets. That's why I don't have hardware wallet yet. But yeah, there haven't. So there is just a lot of confusion, but hopefully it will be possible to get out from it. So yeah. That's what I can tell now. Let's check out some other insights. Still, it says 1.7 million in Ethereum stolen from open C users. People who were stolen are getting widely different refunds from open C. Uhm? So yeah, there are so many reports, but let's let's see what happens next. Come. Open had plans to revise its smart contracts that cut governing starting platform virally and brand new contract. On Friday I upgraded contract was intended to ensure all the active listing on the platform would eventually expire on Twitter. Trider shared what they initially software official open about the migration process. Stated that the rumored exploit was most likely a malicious contract hidden in disguise Lane. The company site cited the same mass email about the migration process as one of the possible sources of the link, the parent attackers address holds about 1.7 million of. So yeah, you see this pretty smart attack like in the moment when open sea was planning to revise smart contract. Basically some guy, just a girl like scientists. Fishing in my area and people were thinking this completely legit because it was actually sent from like open sea. Are your domain, so that's super weird? Like how can you do that? And then there was just link and you needed to click it. So just be super careful with all of that and use hardware wallets. If you have any other insights about it. Yeah, feel free to check out my website Mr Haag. Subscribe to my podcast and let's discuss it.