Lessons From Proof Founder Kevin Rose’s $1.4M NFT Phishing Experience

The founder of Moonbirds lost high-value NFTs from collections including Autoglyph, Chromie Squiggles and Damien Hirst’s The Currency

article-image

Source: Shutterstock / Philip Steury Photography, modified by Blockworks

share

Kevin Rose, the CEO and founder of Proof, fell victim to an apparent phishing attack, with his hacked wallet estimated to have held rare NFTs worth millions. 

After the theft, Rose worked with OpenSea to ensure the stolen NFTs can’t be sold on its marketplace, but they can still be sold on another platform.

His wallet is said to have lost 40 NFTs on Wednesday, with data on NFT marketplace OpenSea showing the assets were transferred to the attacker’s wallet.

Rose confirmed the hack in a late Thursday tweet, saying he would share details soon as a cautionary heads-up. He may have lost assets upwards of $1.4 million including NFTs from collections like Autoglyph, QQL Pass, Cool Cats, Damien Hirst’s The Currency, Admit One and OnChainMonkey, according to nft now

Loading Tweet..

In a Twitter thread, Proof’s VP of Engineering Arran Schlosberg broke down what exactly went down. He said Rose was tricked into signing a malicious signature that allowed the hacker to gain access to high-value tokens. 

Schlosberg didn’t mention what Rose thought he was signing, but the single misstep appears to have given the hacker his wallet credentials.  

“This was a classic piece of social engineering, tricking KRO into a false sense of security. The technical aspect of the hack was limited to crafting signatures accepted by OpenSea’s marketplace contract,” Schlosberg wrote.

Loading Tweet..

He added that Proof’s assets, which mostly need multiple approvals for access, were not impacted.

OpenSea didn’t return Blockworks’ request for comment by press time. 

The NFT phishing problem

Blockchain sleuth ZachXBT claimed that the same hacker who took control of Rose’s NFTs stole 75 ETH ($121,000) from another victim on the same day. The hacker then allegedly used crypto exchange FixedFloat to convert the stolen funds to bitcoin, before transferring them to a bitcoin mixing service to conceal the origin of funds.

Another crypto enthusiast who goes by the name ‘foobar’ on Twitter suggested how such a hack could have been prevented. They recommended a technique known as “wallet siloing,” which involves segregating different wallets for different purposes, and keeping valuable NFTs away from any active hot wallets. This would block the assets from being listed on NFT marketplaces without separate selling approval — a loss of convenience, but a defense against the sort of trap Rose fell into.

Use of a browser extension such as Fire, that translates opaque smart contract code into recognizable actions, would also have tipped off Rose that something smelled fishy before it was too late.

This story was updated on Jan. 26, 2023, at 5:25 a.m. ET with additional detail.


Get the news in your inbox. Explore Blockworks newsletters:

  • Blockworks Daily: The newsletter that helps thousands of investors understand crypto and the markets, by Byron Gilliam.
  • Empire: Start your morning with the top news and analysis to inform your day in crypto.
  • Forward Guidance: Reporting and analysis on the growing intersection of crypto and macroeconomics, policy and finance.
  • 0xResearch: Alpha directly in your inbox. Market highlights, data, degen trade ideas, governance updates, token performance and more.
  • Lightspeed: Built for Solana investors, developers and community members. The latest from one of crypto’s hottest networks.
  • The Drop: For crypto collectors and traders, covering apps, games, memes and more.
  • Supply Shock: Tracking Bitcoin’s rise from internet plaything worth less than a penny to global phenomenon disrupting money as we know it.
Tags

Upcoming Events

Industry City | Brooklyn, NY

TUES - THURS, JUNE 24 - 26, 2025

Permissionless IV serves as the definitive gathering for crypto’s technical founders, developers, and builders to come together and create the future.If you’re ready to shape the future of crypto, Permissionless IV is where it happens.

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

recent research

tg trading bot report graphic.png

Research

Telegram trading bots have found their primary niche in highly speculative token launches and retail-dominated memecoin markets, with many features specifically tailored to token sniping and copy-trading strategies.

article-image

Paradigm’s Charlie Noyes thinks that the attention on stablecoins is well-deserved after Mesh’s $82 million round

article-image

Crypto may benefit from developments during the second quarter after a rough start to the year

article-image

With a friendlier regulatory outlook and the airdrop flow being stemmed, some are looking to how new native tokens can become valuable assets

article-image

The recent action paints an uncertain picture for future monetary policy moves

article-image

Is the finance world becoming “more liquid”? Experts give their takes as TradFi players consider new moves