Shalini Nagarajan


<p>Kevin Rose, the CEO and founder of Proof, fell victim to an apparent <a href="https://blockworks.co/tag/phishing">phishing</a> attack, with his hacked wallet estimated to have held rare NFTs worth millions. </p>



<p>After the theft, Rose worked with OpenSea to ensure the stolen NFTs can’t be sold on its marketplace, but they can still be sold on another platform.</p>



<p>His wallet is said to have lost 40 NFTs on Wednesday, with <a href="https://opensea.io/KROVAULT/activity" target="_blank" rel="noreferrer noopener">data</a> on NFT marketplace OpenSea showing the assets were transferred to the attacker’s <a href="https://etherscan.io/tx/0x4ae899024f8bfcb3448364dc603db2e6ed4eab7b3a8649176230d7e33e644d44" target="_blank" rel="noreferrer noopener">wallet</a>.</p>



<p>Rose confirmed the hack in a late Thursday <a href="https://twitter.com/kevinrose/status/1618323487067869184">tweet</a>, saying he would share details soon as a cautionary heads-up. He may have lost assets upwards of $1.4 million including NFTs from collections like <a href="https://opensea.io/collection/autoglyphs" target="_blank" rel="noreferrer noopener">Autoglyph</a>, QQL Pass, Cool Cats, Damien Hirst’s The Currency, Admit One and OnChainMonkey, according to <a href="https://twitter.com/nftnow/status/1618325566889029633" target="_blank" rel="noreferrer noopener">nft now</a>. </p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">Kevin Rose was just lost $2m+ in assets by signing an off-chain signature that created a listing for all of his OpenSea approved assets in one go.<br><br>While seaport is a powerful tool, it can also be dangerous if you&#39;re not aware of how it works.<br><br>A bit of context 1/🧵</p>&mdash; quit (@0xQuit) <a href="https://twitter.com/0xQuit/status/1618335012176400384?ref_src=twsrc%5Etfw">January 25, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>In a <a href="https://twitter.com/divergencearran/status/1618359162551009281" target="_blank" rel="noreferrer noopener">Twitter thread</a>, Proof’s VP of Engineering Arran Schlosberg broke down what exactly went down. He said Rose was tricked into signing a malicious signature that allowed the hacker to gain access to high-value tokens. </p>



<p>Schlosberg didn’t mention what Rose thought he was signing, but the single misstep appears to have given the hacker his wallet credentials.&nbsp;&nbsp;</p>



<p>“This was a classic piece of social engineering, tricking KRO into a false sense of security. The technical aspect of the hack was limited to crafting signatures accepted by OpenSea&#8217;s marketplace contract,” Schlosberg wrote.</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">This was the one (and only) signature that Kevin Rose signed that cost him ~$2 million. <a href="https://t.co/fHbPb7vc6y">pic.twitter.com/fHbPb7vc6y</a></p>&mdash; 6457.eth (@JKrantz) <a href="https://twitter.com/JKrantz/status/1618338567327186945?ref_src=twsrc%5Etfw">January 25, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>He added that Proof’s assets, which mostly need multiple approvals for access, were not impacted.</p>



<p>OpenSea didn’t return Blockworks’ request for comment by press time. </p>



<h3 class="wp-block-heading">The NFT phishing problem</h3>



<p>Blockchain sleuth ZachXBT <a href="https://twitter.com/zachxbt/status/1618360113190031360" target="_blank" rel="noreferrer noopener">claimed</a> that the same hacker who took control of Rose’s NFTs stole 75 ETH ($121,000) from another victim on the same day. The hacker then allegedly used crypto exchange FixedFloat to convert the stolen funds to bitcoin, before transferring them to a bitcoin mixing service to conceal the origin of funds.</p>



<p>Another crypto enthusiast who goes by the name ‘foobar’ on Twitter <a href="https://twitter.com/0xfoobar/status/1618328914119790594" target="_blank" rel="noreferrer noopener">suggested</a> how such a hack could have been prevented. They recommended a technique known as “wallet siloing,” which involves segregating different wallets for different purposes, and keeping valuable NFTs away from any active hot wallets. This would block the assets from being listed on NFT marketplaces without separate selling approval — a loss of convenience, but a defense against the sort of trap Rose fell into.</p>



<p>Use of a browser extension such as <a href="https://www.joinfire.xyz/" target="_blank" rel="noreferrer noopener">Fire</a>, that translates opaque smart contract code into recognizable actions, would also have tipped off Rose that something smelled fishy before it was too late.</p>



<p><em>This story was updated on Jan. 26, 2023, at 5:25 a.m. ET with additional detail.</em></p>



<hr class="wp-block-separator has-alpha-channel-opacity"/>



<p><strong>Get the news in your inbox. Explore Blockworks newsletters:</strong></p>



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown"><strong>The Breakdown</strong></a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch"><strong>0xResearch</strong></a>: Alpha in your inbox. Think like an analyst. </li>
</ul>


Kevin Rose

Newsletter

Blockworks Research