Katherine Ross

The Department of Justice on Monday unsealed charges against a Moroccan national accused of impersonating OpenSea marketplace functions in order to make off with cryptocurrencies and NFTs — including a Bored Ape.&nbsp;



Prosecutors accused Soufiane Oulahyane, 25, of defrauding a Manhattan resident and others of approximately $450,000 of digital assets in September 2021.&nbsp;



The DOJ alleges Oulahyane “spoofed” <a href="https://blockworks.co/tag/opensea">OpenSea</a>, creating a site that mimicked the real OpenSea to trick customers into logging in and swiping their OpenSea credentials in the process. He allegedly bought “paid advertisements on a popular search engine” to boost the fake page.



“Oulahyane is alleged to have operated a spoof website to gain unauthorized access to victims’ cryptocurrency wallets to steal their cryptocurrency and NFTs,” FBI Acting Assistant Director in Charge Christie Curtis <a href="https://www.justice.gov/usao-sdny/pr/defendant-charged-theft-cryptocurrency-and-nfts-through-spoofing-opensea-marketplace">said</a>.&nbsp;



The <a href="https://blockworks.co/tag/doj">DOJ</a> charged Oulahyane with wire fraud, aggravated identity theft, affecting transactions “with an unauthorized device” and use of an unauthorized device.&nbsp;



Wire fraud alone carries a maximum sentence of 20 years, while using an unauthorized device carries a possible 10-year sentence, and impacting transactions carries up to 15 years. Oulahyane also faces a potential two-year sentence for identity theft. He’s in Moroccan custody, according to officials.&nbsp;



According to the unsealed charges, Oulahyane stole a seed phrase from a New York-based victim’s wallet after the victim accidentally landed on the fake OpenSea login page — designed by Oulahyane — and not the actual marketplace. From there, Oulahyane was able to steal 39 NFTs, including their Bored Ape.



Prosecutors for the Southern District of New York said they have jurisdiction over the case because of the location of the victims — and have brought the charges forward.&nbsp;



Apart from NFTs, Oulahyane is accused of stealing ether (<a href="https://blockworks.co/price/eth">ETH</a>).



Both the DOJ’s press release and <a href="https://www.justice.gov/media/1304796/dl?inline">indictment</a> included pictures of allegedly stolen NFTs, ranging from the BAYC to a Bored Ape Kennel Club NFT. 



Last year, <a href="https://blockworks.co/news/french-authorities-charge-5-over-theft-of-bored-ape-nfts">French authorities charged five people</a> with stealing Bored Ape NFTs after ZachXBT posted his findings on Twitter.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

DOJ alleges Moroccan man spoofed OpenSea, stole BAYC NFT

Shalini Nagarajan

A former chief technology officer of NFT platform Blockparty was arrested and charged for allegedly extorting $1 million, which he agreed to hold in his account while the company looked for a banking partner.



Rikesh Thapa, a 28-year-old from San Diego, California, used his leadership position to steal at least 10 bitcoin for his own advantage between December 2017 and September 2019, the Department of Justice <a href="https://www.justice.gov/usao-sdny/pr/chief-technology-officer-blockchain-company-charged-scheme-defraud-company-over-1" target="_blank" rel="noreferrer noopener">said</a> on Wednesday.



He allegedly used the assets on personal expenses including nightclubs, travel and clothing. Thapa faked records to cover his tracks.



“The defendant repeatedly stole from and defrauded the victim company — which he cofounded — in order to fund a luxurious personal lifestyle,” said Michael J. Driscoll, FBI assistant director in charge.



New Jersey-based Blockparty ventured out as a blockchain-based event ticketing platform in 2017, but the company launched an NFT creation and sale platform in 2020.



Blockparty was allegedly looking to branch out its banking options at a time when financial institutions were reluctant to transact with crypto companies in 2018. So, Thapa decided to hold $1 million of the platform’s money in his personal bank account while it figured out alternatives.



Blockworks reached out to Blockparty for comment but didn’t hear back by press time.



Thapa purportedly told a colleague that the funds were “a stationary 1mil in my account” that was not “touched or interacted with.” But he actually blew it on personal expenses.



In the summer of 2019, Blockparty’s CEO allegedly asked Thapa to return the $1 million. But he was refused, as the defendant said he needed to discuss potential tax consequences with an accountant and attorney. He resigned soon after.



Additionally, Thapa allegedly stole some 174,285 of Blockparty’s utility tokens to sell them to supposed investors in return for cash — without alerting the CEO. He later claimed the cash received was counterfeit.



He faces 20 years in prison if convicted on one count of wire fraud.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Ex-Blockparty CTO Arrested for Stealing Company’s Bitcoin

Sebastian Sinclair

<div id="highlights-block_6347c03eab5ae" class="highlights">
 <ul>
 <li>The individuals charged with the theft are said to be aged between 19 and 23</li>
 <li>Police investigations began in earnest after witnessing an internet sleuth attempting to track the stolen tokens</li>
 </ul>
 
</div>



French authorities have charged five young individuals for allegedly using a phishing website to scam victims out of millions of dollars worth of their NFTs, including those belonging to the Bored Ape Yacht Club collection.



The five are said to have belonged to a criminal gang that stole the tokens, worth an estimated $2.5 million, between late last year and early this year, <a href="https://www.bfmtv.com/crypto/nft/bored-ape-cinq-personnes-mises-en-examen-a-paris-pour-le-vol-d-une-collection-de-nft_AD-202210120607.html" target="_blank" rel="noreferrer noopener">local media</a> reported. 



The alleged scheme saw the individuals use a website to con victims into handing over their tokens under false pretenses. The site promised to transform their tokens from static images into animated ones.



Among the five indicted, two are suspected of having masterminded the website including marketing. The other three are suspected of having conducted advertising for the site as well as money laundering.



Police said they opened an investigation in late August after being made aware of an <a href="https://zachxbt.mirror.xyz/8k0TmMxxieSiwUfUlqFFKGDVoOx2SnneYti31hoHwUk" target="_blank" rel="noreferrer noopener">analysis</a> conducted by self-styled crypto-sleuth ZachXBT, who’d <a href="https://twitter.com/zachxbt/status/1556791003469647872" target="_blank" rel="noreferrer noopener">posted his findings</a> to Twitter. Two of the individuals are said to have been identified using Zach’s detective work.



Around that time, Zach had identified at least three victims who’d been subjected to the scam. Police have identified five victims, including one individual who’d had three NFTs stolen, with one of the Bored Apes estimated to be worth over a million dollars.



“Over the past year, we’ve seen scammers become more creative with new methods to phish people in Web3,” Zach said at the time.



As a result of its own investigation, the Central Office for the Fight against Crime Related to Information and Communication Technologies — the country’s cybercrimes unit — placed seven people in police custody on Monday.



That included the five individuals charged, aged between 19-24, as well as the parents of one suspect — though the parents have since been released without prosecution at this stage, according to the report.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

French Authorities Charge 5 Over Theft of Bored Ape NFTs

Jack Kubinec

<div id="highlights-block_62bc42c09b064" class="highlights">
 <ul>
 <li>Few DeFi companies employ dedicated security personnel</li>
 <li>Industry experts believe bridges will become more secure as DeFi matures</li>
 </ul>
 
</div>



As investment in cryptocurrency grows, so does the incentive for criminal actors to exploit the DeFi (decentralized finance) space. Cross-chain bridge hacks have been the weapon of choice for crypto thieves in 2022. Bridge hacks have accounted for more than a billion dollars in stolen funds this year, according to research from blockchain analytics and compliance firm Elliptic.



Cross-chain bridges allow assets to be moved between different blockchain protocols, meaning the networks contain a large concentration of crypto assets. The recent string of bridge attacks has caused some industry leaders to question whether the benefits of bridges outweigh their risks. A top analyst at Elliptic believes bridge hacks are just growing pains that DeFi will eventually surmount.



<a href="https://cms.blockworks.co/defi-cross-chain-horizon-bridge-hacked-for-100m/" target="_blank" rel="noreferrer noopener">Harmony</a>, <a href="https://cms.blockworks.co/sky-mavis-ronin-network-bridge-exploited-for-over-600m/" target="_blank" rel="noreferrer noopener">Sky Mavis</a>, and <a href="https://cms.blockworks.co/in-second-largest-defi-hack-ever-blockchain-bridge-loses-320m-ether/" target="_blank" rel="noreferrer noopener">Wormhole</a> all suffered blockchain exploits exceeding $100 million this year. Mudit Gupta, Chief Information Security Officer at Polygon, believes bridge insecurity is an industry-wide problem.



“Most of the hacks are happening due to companies not having proper security experts and not knowing what to do themselves,” Gupta said in a Twitter DM. “There are very few DeFi companies with [dedicated] security personnel.”



DeFi protocols have proliferated rapidly in the past six years, but security infrastructure has not kept up with the now over-$900 billion industry. For this reason, hacks totaling in the hundreds of millions are not surprising.&nbsp;



On April 1, a trader tweeted their concern that a major Harmony Horizon Bridge exploit would only require a hacker to obtain two of the protocol’s five validator keys. In June, that exact scenario occurred — and Harmony was ransacked for $100 million.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Since the current narative du-jour is bridges &amp; bridge hacks, I wanted to do some digging on the harmony bridge on Ethereum which secures ~$330m worth of tokens.&mdash; Ape Dev (@_apedev) <a href="https://twitter.com/_apedev/status/1510007663832223751?ref_src=twsrc%5Etfw">April 1, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Vitalik Buterin, co-founder of Ethereum, believes cross-chain bridges are inherently prone to security breaches.



“The fundamental security limits of bridges are actually a key reason why…I am pessimistic about cross-chain applications,” Buterin wrote in a lengthy January Reddit post. The influential founder went on to express his belief that assets should be held in the same blockchain ecosystem, rather than shuffled between chains.



Tara Annison, Head of Technical Crypto Advisory at the crypto research firm Elliptic, disagrees.



“We’re not going to live in a single chain world,” Annison said. It will always be necessary to move assets between blockchains, so “we shouldn’t characterize bridges in general as bad just because some have been hacked.”



Annison believes bridge hacks are caused by the concentration of value within cross-chain bridges, not by the bridges themselves.



<blockquote class="wp-block-quote">“If you think of wars, you try to bomb bridges to stop goods and services moving across,” Annison said. Recent cross-chain bridge hacks are not happening “because bridges are inherently weak infrastructure, it’s because they have a concentration of value.”</blockquote>



Annison believes that all crypto assets come with risk, and bridges are just the risk “flavor of the month” following stablecoins in May and NFTs before that. Bridges should become more secure as protocols become more technologically mature.



It remains to be seen if market participants agree.



Sky Mavis’ Ronin Bridge, which was compromised for $625 million in April, <a href="https://cms.blockworks.co/sky-mavis-reopening-ronin-bridge-with-enhanced-security/" target="_blank" rel="noreferrer noopener">reopened</a> this morning. Close to $9 million in assets have already left the chain, according to Messari.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Cross-chain Bridge Thefts Top $1B in 2022

Ornella Hernandez

<div id="highlights-block_628f85197553a" class="highlights">
 <ul>
 <li>Asset Reality specializes in investigating, tracing and attempting to recover funds</li>
 <li>New service will pool data from a number of scam victims to help trace stolen assets</li>
 </ul>
 
</div>



ConsenSys’ self-custody wallet MetaMask is partnering with Asset Reality, a platform for accessing and recovering seized crypto and digital assets, to tackle cryptocurrency fraud. The two companies will support MetaMask scam and phishing victims in attempting to recover their assets.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">We’ve partnered with <a href="https://twitter.com/MetaMask?ref_src=twsrc%5Etfw">@metamask</a>! We’ll be helping victims of crypto-related fraud to recover their stolen digital assets in an industry-first approach to improving virtual asset recovery. Read more about this exciting new partnership: <a href="https://t.co/WBdRjWp1W0">https://t.co/WBdRjWp1W0</a><a href="https://twitter.com/ConsenSys?ref_src=twsrc%5Etfw">@Consensys</a> <a href="https://twitter.com/hashtag/crypto?src=hash&amp;ref_src=twsrc%5Etfw">#crypto</a>&mdash; Asset Reality | Techstars ‘21 🚀 (@asset_reality) <a href="https://twitter.com/asset_reality/status/1529809582868074496?ref_src=twsrc%5Etfw">May 26, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



The main security concerns for crypto wallet users are phishing scams that cast a wide net, as well as targeted spear-phishing attacks, according to MetaMask. Bad actors most commonly pose as a friendly face offering to help users navigate crypto’s technical jargon and trick users into handing over their funds.&nbsp;



MetaMask’s strategy is to pool information from a number of victims in the hope that it will help both identify the scammer and make recovering the stolen assets less costly. To use the service, victims must <a href="https://fund-loss-investigation.metamask.io/" target="_blank" rel="noreferrer noopener">submit a ticket</a> for investigation.



Some examples of recent attacks include a <a href="https://cms.blockworks.co/metamask-issues-warning-following-icloud-phishing-scam/" target="_blank" rel="noreferrer noopener">$650,000 phishing scam</a> of a MetaMask wallet user targeted by a hacker posing as an Apple employee. MetaMask’s response, which was criticized at the time by community members, was to issue a warning to users whose data were susceptible to hackers because their iCloud backups include their password-encrypted MetaMask vault.



Earlier this week, a Moonbirds NFT holder <a href="https://twitter.com/CirrusNFT/status/1529296043547865088?s=20&amp;t=RZ-rlCczPtsuuzlqXc70ug" target="_blank" rel="noreferrer noopener">lost</a> 29 of his Ethereum-based Moonbirds, worth around $1.5 million at the time, after signing a bad transaction on a fake trading site he reached by clicking a malicious link shared by a scammer. The victim was a member of the Proof Collective, a private group of 1,000 dedicated NFT (non-fungible token) collectors and artists. Although the scammer was <a href="https://twitter.com/knownasdollar/status/1529297355396489217?s=20&amp;t=MVMqcnyASCcJ24AUrlFiBg" target="_blank" rel="noreferrer noopener">identified</a>, only an FBI report was filed.&nbsp;



Harry Denley, an information technology security analyst at MetaMask, told Blockworks that bad actors are “simply taking advantage of a nascent industry where new users are generally optimistic, excited by the potentials, and not very experienced with having full control of such valuable assets.”



Cybercrime is a multi-billion dollar worldwide industry, he added, emphasizing the importance of hack victims coming forward, no matter how small the loss.&nbsp;



Traditional recovery, however, involves lengthy and often costly civil litigation, with no guarantee of recovering funds. According to MetaMask&#8217;s support product lead Alex Herman, digital asset recovery is difficult due to the cryptocurrency’s “pseudo-anonymous” and “immutable” nature. 



“While traditional systems opt for transactions to be reversible and accounts to be frozen, crypto has prioritized the control of the individual user and decentralized systems. Bad actors can also use obfuscation techniques to make it harder to track stolen funds,” Herman told Blockworks.&nbsp;



In the case of a scam, MetaMask will request any relevant information regarding phishing websites, vectors and funds lost, while Asset Reality will handle the case for MetaMask’s affected users. They will build an investigation into each scam operation and manage any communication with the users.



Along with recovery mechanisms in place, MetaMask and Asset Reality hope to protect users by expanding their education tools and offerings on their platform.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

MetaMask Moves To Help Crypto Scam Victims Recover Stolen Digital Assets

David Canellis

<div id="highlights-block_62702010422b2" class="highlights">
 <ul>
 <li>Smart contract hackers targeted merged DeFi projects Rari Capital and Fei Protocol to steal almost $80 million over the weekend</li>
 <li>Rather than seek VC funding to plug the losses, the Tribe DAO, which manages their governance, may vote to make users whole</li>
 </ul>
 
</div>



Crypto platform Fei Protocol hopes a $10 million bounty “with no questions asked” will spur hackers to return nearly $80 million of digital assets stolen over the weekend.



Fei, the stablecoin issuer which merged with crypto lending startup Rari Capital just five months ago, made the <a href="https://twitter.com/feiprotocol/status/1520344430242254849" target="_blank" rel="noreferrer noopener">plea</a> on Twitter hours after the exploit — in which hackers infiltrated the platform’s lending pools — was detected Saturday.



“We are aware of an exploit on various Rari Fuse pools. We have identified the root cause and paused all borrowing to mitigate further damage,” Fei Protocol tweeted. “To the exploiter, please accept a [$10 million] bounty and no questions asked if you return the remaining user funds.”&nbsp;



Rari’s hacker leveraged a critical “<a href="https://consensys.github.io/smart-contract-best-practices/attacks/reentrancy/" target="_blank" rel="noreferrer noopener">reentrancy</a>” bug buried deep within the protocol’s code. These bugs involve smart contracts calling each other to move funds without appropriate checks.&nbsp;



For its codebase, Fei forked (read: copied) Ethereum money market platform Compound in early 2021. Compound enables crypto lending by valuing digital assets. It automatically determines borrowing limits and gauges market conditions to calculate interest rates.



Fei made certain changes to the code, however, and despite audits the flaw wasn&#8217;t discovered until it was too late.



Compound forks have <a href="https://quantstamp.com/blog/how-the-dforce-hacker-used-reentrancy-to-steal-25-million" target="_blank" rel="noreferrer noopener">suffered</a> similar fates in the past. Rari even <a href="https://medium.com/@JackLongarzo/rari-capital-fuse-security-upgrade-report-e5d154c16250" target="_blank" rel="noreferrer noopener">paid</a> $2 million to security researchers who had discovered a nearly identical flaw in March.



Decentralized exchange Uniswap, DeFi platform Cream Finance, and The Dao, among other projects, have fallen victim to reentrancy attacks dating back to 2016.&nbsp;



Rari also lost $11 million to smart contract hackers in an unrelated attack last May, then about 60% of the protocol’s capital.



In this case, Rari Fuse lending pools (which facilitate the lending of related ERC-20 tokens) effectively failed to keep track of how much cryptocurrency had been borrowed.



The setup illegitimately allowed for the borrowing of large amounts of cryptocurrency, withdrawal of the loan’s collateral and retention of borrowed funds, <a href="https://certik.medium.com/fei-protocol-incident-analysis-8527440696cc" target="_blank" rel="noreferrer noopener">according to smart contract auditor CertiK</a>.



The hackers flash-loaned $150 million worth of stablecoin USDC and 50,000 WETH ($141.5 million) to power more crypto loans from seven Rari Fuse pools.



After triggering a buggy “exitMarket” smart contract function, they withdrew the collateral, repaid the flash loan and kept the “borrowed” funds from Rari Fuse. The hackers repeated this process until they’d amassed roughly $80 million of crypto.



Rari Capital later <a href="https://twitter.com/RariCapital/status/1520651835081740290" target="_blank" rel="noreferrer noopener">disclosed</a> another 100 ETH had been hacked Sunday from a Fuse pool on layer-2 Ethereum platform Arbitrum.



BlockSec Chief Technology Officer Lei Wu confirmed to Blockworks that 5,400 ETH of the pilfered stash had been sent to crypto mixer <a href="https://cms.blockworks.co/the-purpose-and-perils-of-crypto-privacy-tools/" target="_blank" rel="noreferrer noopener">Tornado Cash</a>.



The stolen funds essentially belong to Rari Fuse users who had loaned their crypto. With this in mind, Fei Protocol is not exactly the victim — despite the exploit targeting its source code.&nbsp;



Rari developer Jack Longarzo told Blockworks that Rari’s Fuse platform and the Tribe DAO that manages Fei and Rari’s governance are the real victims. In fact, Tribe DAO may deliberate whether to release funds from its treasuries to make Rari Fuse users whole. Its treasury is currently worth $104 million, according to <a href="https://openorgs.info/" target="_blank" rel="noreferrer noopener">OpenOrgs</a>.



While there’s no formal bailout proposal as yet (and Longarzo wouldn’t comment on whether one was in the works), such a move would starkly contrast the VC-funded bailouts of other embattled DeFi platforms such as <a href="https://cms.blockworks.co/wormhole-parent-commits-320m-ether-to-replace-massive-defi-hack-losses/" target="_blank" rel="noreferrer noopener">Wormhole</a> and <a href="https://cms.blockworks.co/the-ronin-hacker-made-off-with-625m-of-crypto-but-cashing-out-isnt-so-easy/" target="_blank" rel="noreferrer noopener">Ronin</a>, which have generally involved more centralized and private decision-making than a community vote.



But there is some indication that Tribe DAO participants may be losing faith. The DAO’s native token, TRIBE, is down 20% since the attack was first disclosed.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Hacked Crypto Platform Offers ‘No Questions Asked’ $10M Bounty for Stolen Funds

Jacquelyn Melinek

<div id="highlights-block_6213d0e566244" class="highlights">
 <ul>
 <li>“This attack did not originate on [OpenSea],” the company’s CEO and co-founder said</li>
 <li>Last week, OpenSea launched a customer service server to mitigate risk of fraudsters pretending to be members of the company’s staff</li>
 </ul>
 
</div>



NFT traders Monday were parsing the aftermath of an OpenSea phishing attack that resulted in hundreds of NFTs being stolen over the weekend.



The attack appears to be over, with <a href="https://twitter.com/opensea/status/1495625884514066433?s=20&amp;t=3LoWYvs8qkWE6oZipLav4A" target="_blank" rel="noreferrer noopener">17</a> victims, a revision from the 32 people originally thought to be affected, according to OpenSea.



“This attack did not originate on [OpenSea],” Devin Finzer, CEO and co-founder, wrote in a series of <a href="https://twitter.com/dfinzer/status/1495302786811981825?s=20&amp;t=3LoWYvs8qkWE6oZipLav4A" target="_blank" rel="noreferrer noopener">tweets</a>. The company is working with users as it aims to uncover who is responsible, Finzer said.



Finzer dismissed <a href="https://twitter.com/pluggedinn/status/1495246939838840840?s=20&amp;t=r49pa9TRVJvVvxZOZOOxMQ" target="_blank" rel="noreferrer noopener">reports</a> of the attack being worth over $200 million and said the hacker had <a href="https://etherscan.io/address/0x3E0DeFb880cd8e163baD68ABe66437f99A7A8A74#internaltx" target="_blank" rel="noreferrer noopener">$1.7 million of ether</a> in their wallet, confirmed by Etherscan records.



An OpenSea spokesperson declined to comment further and referred Blockworks to the company’s <a href="https://twitter.com/opensea/status/1495625768713469954?s=20&amp;t=py7J05HKKzaP4ZwDCWhPZA" target="_blank" rel="noreferrer noopener">tweets</a>.



OpenSea is the largest NFT (non-fungible token) marketplace by trading volume and has over 80 million NFTs across two million collections. The platform had $70.78 million in Ethereum-based volume on Monday, down 58% from $169.26 million a month ago, according to <a href="https://dune.xyz/queries/11385/22601" target="_blank" rel="noreferrer noopener">data</a> by Dune Analytics user rchen8.



The hacker made off with 254 NFTs during the attack, including a few Bored Ape Yacht Club NFTs, according to a <a href="https://docs.google.com/spreadsheets/d/1XQNIXuAl2E1XO_cP8pm_vbzskI_Pka4E5sizfcrLITM/edit#gid=0" target="_blank" rel="noreferrer noopener">spreadsheet</a> by blockchain security firm PeckShield. The most NFTs stolen during the phishing attack were 37 <a href="https://opensea.io/collection/azuki" target="_blank" rel="noreferrer noopener">Azukis</a>, according to <a href="https://dune.xyz/Jelilat/Opensea-Phishing-Attack-Stolen-NFTs" target="_blank" rel="noreferrer noopener">data</a> by Dune Analytics user Jelilat.



The users authorized the “migration” as instructed in the phishing email, and the authorization allowed the hacker to steal the NFTs, PeckShield <a href="https://twitter.com/peckshield/status/1495211650860785665?s=20&amp;t=r49pa9TRVJvVvxZOZOOxMQ" target="_blank" rel="noreferrer noopener">tweeted</a>.



As such, the malicious orders were all backed by valid signatures from users who fell for the phishing scam, Nadav Hollander, OpenSea’s chief technology officer <a href="https://twitter.com/NadavAHollander/status/1495509513167908864?s=20&amp;t=r49pa9TRVJvVvxZOZOOxMQ" target="_blank" rel="noreferrer noopener">tweeted</a> Sunday.



The attacker had users connect their crypto wallets to a fraudulent site, according to reports, where they signed approvals with Wyvern Exchange to give the attacker control of their NFTs.&nbsp;



Wyvern Exchange is a decentralized crypto exchange on the Wyvern Protocol that interacts with the Ethereum blockchain.



“The attacker appears to have exploited users by having them sign a fraudulent signature to approve a private sale of [their] NFT at 0 ETH to the attacker’s wallet,” The OpenDAO wrote in a <a href="https://theopendao.medium.com/opensea-phishing-attack-19-february-2022-and-the-opendaos-response-4f71aa80578c" target="_blank" rel="noreferrer noopener">post</a>. “Unfortunately nobody ever reads what they signed.”



Phishing scams often occur through text messages or emails with deceptive messages, ads or sites that look legitimate. While scams happen across industries, some community members call it a mistake for OpenSea to use email in general.



The co-founder of Pixel Vault, who goes by the pseudonym Beanie, called email “an archaic way to communicate” that “opens up even sophisticated users to risk of being exploited through phishing scams.



“The OpenSea email alert system never really worked anyhow, as it was overrun with spam,” Beanie <a href="https://twitter.com/beaniemaxi/status/1495764293484269573?s=20&amp;t=r49pa9TRVJvVvxZOZOOxMQ" target="_blank" rel="noreferrer noopener">tweeted</a>.



While messaging platforms such as Discord or Blockscan Chat allow users to log in with Ethereum addresses to message wallet-to-wallet, there are limited new avenues for companies to communicate with their users.



Last week, OpenSea launched a customer service server with Web3 communications platform Metalink to mitigate the risk of fraudsters pretending to be members of the company’s staff, Blockworks <a href="https://cms.blockworks.co/opensea-looks-to-improve-customer-support-and-fight-fraud/" target="_blank" rel="noreferrer noopener">reported</a>.



“Our goal is to create a direct channel for you to interact with OpenSea to get support, offer feedback, receive updates, and to share any other information that will help us better serve you,” Stevey Tromberg, OpenSea’s head of community, said in a <a href="https://mirror.xyz/metajake.eth/baLwh3UUzhvbDt0n_V9xmxaTsiaoGCb6gOR6KIW-CuA" target="_blank" rel="noreferrer noopener">statement</a>. 



The partnership was created after alleged scammers previously impersonated OpenSea’s employees to <a href="https://cms.blockworks.co/opensea-responds-to-nft-loophole/" target="_blank" rel="noreferrer noopener">deceive</a> other NFT owners in its Discord chat, which resulted in them losing millions of dollars.



“NFT communities deserve a safe and secure place where they can connect and thrive,” Jake Udell, the founder of Metalink, said.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

OpenSea Scammers Went Phishing and Caught Over 250 NFTs From 17 Users

Morgan Chittum

<div id="highlights-block_61ef2e85f59f9" class="highlights">
 <ul>
 <li>Coding bug enabled attackers to buy NFTs at previous sale prices and flip them for substantial profit</li>
 <li>At least three attackers exploited users, according to blockchain analytics firm Elliptic</li>
 </ul>
 
</div>



A bug in the OpenSea NFT marketplace has enabled hackers to snatch up rare NFTs from owners for far below market value and resell them for hefty profits.&nbsp;



At least three attackers exploited a bug on the marketplace, making away with over $1 million as of Monday, according to blockchain analytics firm Elliptic. One of the alleged opportunists bought a Mutant Ape Yacht Club NFT for $10,600 worth of ether, selling it hours later for $34,800 worth of ether.



“The <a href="https://twitter.com/yakirrotem/status/1485559864948629512" target="_blank" rel="noreferrer noopener">exploit</a> appears to originate from the ability to re-list an NFT at a new price, without canceling the previous listing,” Elliptic said in a <a href="https://www.elliptic.co/blog/bug-allows-nfts-worth-over-1-million-to-be-stolen" target="_blank" rel="noreferrer noopener">report.</a> “Those previous listings are now being used to purchase NFTs at prices specified at some point in the past — which is often well below current market prices.”



One attacker, who goes by “<a href="https://opensea.io/jpegdegenlove" target="_blank" rel="noreferrer noopener">jpegdegenlove</a>” online, paid roughly $133,000 for seven NFTs before quickly flipping them on the platform for $934,000 worth of ether.&nbsp;



Suspicious activity picked up over the past day but the bug has been present for weeks and was flagged in a Jan. 1 <a href="https://twitter.com/carsonturner/status/1477414895834513413?s=20" target="_blank" rel="noreferrer noopener">tweet</a>. The marketplace was exploited over eight times in a roughly eight-hour-span on Monday morning. A <a href="https://etherscan.io/address/0xb1a22cc48f6784f629a994917cd6474923630c48" target="_blank" rel="noreferrer noopener">wallet address</a> associated with multiple purchases has made a total profit of $878,288 worth of ether from the exploit, according to blockchain analytics provider <a href="https://pro.nansen.ai/nft-wallet-profiler?address=0xb1A22cc48f6784F629A994917cD6474923630C48" target="_blank" rel="noreferrer noopener">Nansen</a>.&nbsp;



<blockquote class="wp-block-quote">“The fact that a user could buy at previous prices and flip NFTs without any form of verification points to the centralization issue in NFTs as they stand right now,” Jenna Pilgrim, CEO of blockchain media licensing startup Streambed, told Blockworks. </blockquote>



“OpenSea does a great job at creating a solid user interface, but unfortunately does so at the cost of security,” she added.&nbsp;



In a turn of events, “jpegdegenlove” later compensated two of their victims, transferring them a combined total of $75,000 worth of ether, according to Elliptic.&nbsp;



Charles Guillemet, CTO of hardware wallet developer Ledger, said that it is currently not safe for NFT holders to have their assets listed on OpenSea. “It’s very difficult to use this platform securely right now,” he said on a Twitter space Monday. “The only thing we can do is to mitigate the risk.”



OpenSea has yet to publicly address the exploit and did not immediately respond to Blockworks’ request for comment on the matter.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Attackers Exploit OpenSea Loophole to Snatch and Resell Rare NFTs

Macauley Peterson

<div id="highlights-block_61e630208d561" class="highlights">
 <ul>
 <li> Crypto.com has increased the amount of its venture arm fund to the tune of $500 million, up from $200 million</li>
 <li>The fund will continue to focus on crypto startups but remains agile to changes within the industry</li>
 </ul>
 
</div>



Singapore-headquartered exchange Crypto.com has increased the amount of its venture arm fund to the tune of $500 million, <a href="https://techcrunch.com/2022/01/17/crypto-com-500-million-fund-web3/" target="_blank" rel="noreferrer noopener">TechCrunch reported</a> Monday.



Founded in March 2021, Crypto.com Capital, the exchange&#8217;s venture arm, began with around $200 million in the tank to back early-stage startups looking to build Web 3 applications and platforms.



The fund will continue to focus on those startups but remains agile to change, according to Asia-based General Partner, Jon Russell, who stepped into the role on Monday.



Crypto.com Capital typically leads seed rounds ranging between $100K to $3 million and Series A rounds from around $3 million to $10 million, according to its <a href="https://www.crunchbase.com/organization/crypto-com-capital" target="_blank" rel="noreferrer noopener">Crunchbase profile</a>.



The $300 million addition is expected to put it on an equal footing with other exchange venture arms, including Binance&#8217;s and Coinbase&#8217;s. Indeed, venture capital from major exchanges is both symbiotic and beneficial to those looking to forge new projects and attract further capital into the fold.



A trend is now beginning to form which has seen year-over-year growth of venture capital funds pouring money into the space. Last year saw <a href="https://au.finance.yahoo.com/news/crypto-startups-get-record-amount-of-vc-money-may-lead-to-more-ip-os-in-2022-185523469.html" target="_blank" rel="noreferrer noopener">$33 billion</a> worth of VC funding — the highest amount in comparison to all previous years combined, Yahoo Finance recently reported.



Most recently, FTX <a href="https://cms.blockworks.co/ftx-launches-2b-venture-fund/" target="_blank" rel="noreferrer noopener">announced the launch</a> of a $2 billion venture capital fund on Jan 14.



“If you’re in the industry, it’s in your interest to help companies grow in the ecosystem and the ecosystem itself to grow,”&nbsp;said Russell.



<h3 class="wp-block-heading">Crypto.com suffers security incident</h3>



Alongside the funding announcement, Crypto.com faced a security breach which caused &#8220;<a href="https://twitter.com/cryptocom/status/1483050866894868484" target="_blank" rel="noreferrer noopener">unauthorized activity</a>&#8221; in some user accounts, prompting the company to reset all customers&#8217; two-factor authentication.



Audit firm Peckshield <a href="https://twitter.com/peckshield/status/1483246262371557378" target="_blank" rel="noreferrer noopener">reports</a> that wallets linked to the company lost about $15 million worth of ether.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">The <a href="https://twitter.com/cryptocom?ref_src=twsrc%5Etfw">@cryptocom</a> loss is about $15M with at least 4.6K ETHs and half of them are currently being washed via <a href="https://twitter.com/TornadoCash?ref_src=twsrc%5Etfw">@TornadoCash</a> <a href="https://t.co/PUl6IrB3cp">https://t.co/PUl6IrB3cp</a> <a href="https://t.co/6SVKvk8PLf">https://t.co/6SVKvk8PLf</a> <a href="https://t.co/XN9nmT857j">pic.twitter.com/XN9nmT857j</a>&mdash; PeckShield Inc. (@peckshield) <a href="https://twitter.com/peckshield/status/1483246262371557378?ref_src=twsrc%5Etfw">January 18, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



However, CEO Kris Marszalek <a href="https://twitter.com/Kris_HK/status/1483277458262859776?s=20" target="_blank" rel="noreferrer noopener">stressed on Twitter</a> that &#8220;no customer funds were lost,&#8221; and promised to release a full postmortem following an internal investigation into the incident.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Crypto.com Bolsters Venture Arm to $500M

<div id="highlights-block_61c4f5bed06bd" class="highlights">
 <ul>
 <li>“I consider [code is law] a fringe and unworkable view of how DeFi actually needs to work if it’s going to be more widely adopted,” Day said</li>
 <li>A series of tweets by a nondescript Twitter profile ZetaZeroes, which allegedly claims to be Medjedovic, has hinted that what occurred was crypto trading</li>
 </ul>
 
</div>



A class-action lawsuit unfolding in Canada could upend the view that conventional law does not apply to unregulated decentralized finance (DeFi) protocols. The claim against Canadian teenager Andean Medjedovic, who allegedly stole $15.8 million from a DeFi protocol, Indexed Finance, argues that the so-called ‘code is law’ convention in DeFi doesn’t provide immunity from conventional laws.&nbsp;



“Code is law,” often jokingly referred to as codeslaw, is a popular idea among DeFi communities that without real-life regulation, the DeFi (or crypto) ecosystem is regulated by code’s permissibility.&nbsp;



Indexed Finance is a DAO that describes itself as a “decentralized protocol for passive portfolio management on Ethereum.”&nbsp;



A series of <a href="https://twitter.com/ZetaZeroes/status/1451065309213962247">tweets</a> by a nondescript Twitter profile ZetaZeroes, which allegedly claims to be Medjedovic, has hinted that what occurred was crypto trading, simply put. Indexed Finance’s Co-founder Dillon Kellar and a contributor, Laurence Day, claim the convention doesn’t apply in this case and are suing the alleged hacker to find out. A notice of action was <a href="https://drive.google.com/drive/folders/1BtZy-xt_KrQGKQ1ZhukBPXB-slXfmTBW">filed</a> on Dec. 17 with the Ontario Superior Court of Justice relating to a proposed class action lawsuit against Medjedovic.



“I consider [code is law] a fringe and unworkable view of how DeFi actually needs to work if it’s going to be more widely adopted,” Day said in a message to Blockworks. “We operate in a space where perpetrators are…rarely found, which probably helps perpetuate the idea,” he wrote.&nbsp;



Day said if code was law, it would set DeFi on a “pretty dystopian path where exploiters were lauded.”&nbsp;&nbsp;



The idea of “just don’t get hacked” is a “cop-out that can realistically never be guaranteed” for any protocol, even in light of audits and open-source scrutiny, Day noted.&nbsp;



“A lot of the ‘code is law’ appreciators seem to think that DeFi stands entirely outside of the framework of law, as opposed to simply being a manner of disintermediating financial institutions,” Day said. “Just because all of this happens through a blockchain doesn&#8217;t mean that suddenly hundreds of years of legal process magically stop applying,” he added.&nbsp;



A number of lawyers are saying Medjedovic’s “code is law” argument probably will not be upheld under legal scrutiny, CoinDesk <a href="https://www.coindesk.com/policy/2021/12/22/teenage-suspect-in-16m-defi-hack-wanted-for-arrest-in-canada/">reported</a>.&nbsp;



The 19-year-old, who was 18 at the time of the attack, allegedly executed a series of trades, through $159 million of borrowed assets by using a flash loan. The filing claims he then distorted the protocol’s algorithm to buy assets at “artificially deflated prices” for a fraction of their true value.&nbsp;



Around the time of the incident, ZetaZeroes <a href="https://twitter.com/ZetaZeroes/status/1449559819988488194?s=20">tweeted</a> that the protocol was “out-traded” and “there is nothing you can do about that.”&nbsp;



But, the digital assets stored in Medjedovic’s crypto wallet are the “rightful property of the tokenholders,” the filing stated.&nbsp;



“Thieves shouldn’t be encouraged or comforted by the fact that ‘code is law,’ or believe that they have a free pass to take assets that aren’t theirs simply because those assets exist on a distributed ledger,” Day said.



Medjedovic did not respond to Blockworks’ request for comment.