Shalini Nagarajan

Kevin Rose, the CEO and founder of Proof, fell victim to an apparent <a href="https://blockworks.co/tag/phishing">phishing</a> attack, with his hacked wallet estimated to have held rare NFTs worth millions. 



After the theft, Rose worked with OpenSea to ensure the stolen NFTs can’t be sold on its marketplace, but they can still be sold on another platform.



His wallet is said to have lost 40 NFTs on Wednesday, with <a href="https://opensea.io/KROVAULT/activity" target="_blank" rel="noreferrer noopener">data</a> on NFT marketplace OpenSea showing the assets were transferred to the attacker’s <a href="https://etherscan.io/tx/0x4ae899024f8bfcb3448364dc603db2e6ed4eab7b3a8649176230d7e33e644d44" target="_blank" rel="noreferrer noopener">wallet</a>.



Rose confirmed the hack in a late Thursday <a href="https://twitter.com/kevinrose/status/1618323487067869184">tweet</a>, saying he would share details soon as a cautionary heads-up. He may have lost assets upwards of $1.4 million including NFTs from collections like <a href="https://opensea.io/collection/autoglyphs" target="_blank" rel="noreferrer noopener">Autoglyph</a>, QQL Pass, Cool Cats, Damien Hirst’s The Currency, Admit One and OnChainMonkey, according to <a href="https://twitter.com/nftnow/status/1618325566889029633" target="_blank" rel="noreferrer noopener">nft now</a>. 



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Kevin Rose was just lost $2m+ in assets by signing an off-chain signature that created a listing for all of his OpenSea approved assets in one go. While seaport is a powerful tool, it can also be dangerous if you&#39;re not aware of how it works. A bit of context 1/🧵&mdash; quit (@0xQuit) <a href="https://twitter.com/0xQuit/status/1618335012176400384?ref_src=twsrc%5Etfw">January 25, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



In a <a href="https://twitter.com/divergencearran/status/1618359162551009281" target="_blank" rel="noreferrer noopener">Twitter thread</a>, Proof’s VP of Engineering Arran Schlosberg broke down what exactly went down. He said Rose was tricked into signing a malicious signature that allowed the hacker to gain access to high-value tokens. 



Schlosberg didn’t mention what Rose thought he was signing, but the single misstep appears to have given the hacker his wallet credentials.&nbsp;&nbsp;



“This was a classic piece of social engineering, tricking KRO into a false sense of security. The technical aspect of the hack was limited to crafting signatures accepted by OpenSea&#8217;s marketplace contract,” Schlosberg wrote.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">This was the one (and only) signature that Kevin Rose signed that cost him ~$2 million. <a href="https://t.co/fHbPb7vc6y">pic.twitter.com/fHbPb7vc6y</a>&mdash; 6457.eth (@JKrantz) <a href="https://twitter.com/JKrantz/status/1618338567327186945?ref_src=twsrc%5Etfw">January 25, 2023</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



He added that Proof’s assets, which mostly need multiple approvals for access, were not impacted.



OpenSea didn’t return Blockworks’ request for comment by press time. 



<h3 class="wp-block-heading">The NFT phishing problem</h3>



Blockchain sleuth ZachXBT <a href="https://twitter.com/zachxbt/status/1618360113190031360" target="_blank" rel="noreferrer noopener">claimed</a> that the same hacker who took control of Rose’s NFTs stole 75 ETH ($121,000) from another victim on the same day. The hacker then allegedly used crypto exchange FixedFloat to convert the stolen funds to bitcoin, before transferring them to a bitcoin mixing service to conceal the origin of funds.



Another crypto enthusiast who goes by the name ‘foobar’ on Twitter <a href="https://twitter.com/0xfoobar/status/1618328914119790594" target="_blank" rel="noreferrer noopener">suggested</a> how such a hack could have been prevented. They recommended a technique known as “wallet siloing,” which involves segregating different wallets for different purposes, and keeping valuable NFTs away from any active hot wallets. This would block the assets from being listed on NFT marketplaces without separate selling approval — a loss of convenience, but a defense against the sort of trap Rose fell into.



Use of a browser extension such as <a href="https://www.joinfire.xyz/" target="_blank" rel="noreferrer noopener">Fire</a>, that translates opaque smart contract code into recognizable actions, would also have tipped off Rose that something smelled fishy before it was too late.



This story was updated on Jan. 26, 2023, at 5:25 a.m. ET with additional detail.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

hacks

Lessons From Proof Founder Kevin Rose’s $1.4M NFT Phishing Experience

Ornella Hernandez

<div id="highlights-block_62fb90fb5110b" class="highlights">
 <ul>
 <li>Moonbirds’ move to a Creative Commons Zero license sparked debate</li>
 <li>Meebits and CryptoPunks collections have updated the terms of service to extend commercial rights use away from creators and to NFT holders</li>
 </ul>
 
</div>



The popular NFT collection, Moonbirds, recently rescinded its holders’ full commercial art rights over the NFTs they own.&nbsp;



Announced via a <a href="https://twitter.com/kevinrose/status/1555262099093200896?s=20&amp;t=OsBUkskNyNnITovpSiPXIQ" target="_blank" rel="noreferrer noopener">Twitter thread</a> by the project founder, Kevin Rose, the move to a Creative Commons Zero (CC0) license stripped holders of any claim to copyright on the intellectual property (IP) and lets the public reuse the image of a Moonbird or Oddity. 



Rose tweeted this move “honors and respects the values of the internet and web3” and “sets Moonbirds and Oddities free” to embrace the CC0 movement.&nbsp;



The greater Moonbirds community was shaken up, and the floor price of the collection has gone from 18 ETH on the day of the announcement on Aug. 4 to 12 ETH at the time of publication. Moonbirds’ trading volume on OpenSea makes it the ninth-most traded collection of all time.&nbsp;



One Moonbirds collector, NFTbark, <a href="https://twitter.com/NFTbark/status/1556980583028359168?s=20&amp;t=gqom_N55hzoFdSAt8aGmRQ" target="_blank" rel="noreferrer noopener">tweeted</a> that many of his friends have sold their NFTs in response. Although he remains hopeful, he said, “this isn’t about cc0. It’s about a loss of trust.”  



The main criticism against the sudden license switch is that it was done without the consent of the community members. The Moonbirds founders, however, acted in their legal right.&nbsp;&nbsp;



According to its terms of service, NFT holders were always subject to whatever the creators decided in the context of commercial rights concerning the image of the NFTs. Moonbirds creators could legally adjust the license without consent from the community.



The fact that creators had given holders the right to own an NFT does not mean that the owners cannot later on give others access to it too, explained Teddy Bornstein, general counsel at authenticated NFT marketplace Ethernity Chain. Any commercial rights that they were given are no longer valid. “Now they’re useless since they put those same rights in the public domain,” he said.&nbsp;



There’s a distinction between NFT collectibles and PFPs versus NFT art, according to Hugh Heslep, Chief Operating Officer of NFT art company Art Blocks.



“When you think of Moonbirds, you don&#8217;t think about the artist&#8217;s name. You don&#8217;t think about the art itself. You think about [Moonbirds’ parent company] Proof Collective. You may think about Kevin himself,” Heslep told Blockworks.



He added that CC0 “may make sense” if the purpose is to expand the community and to create digital assets that can drive utility and value.”&nbsp;



<h3 class="wp-block-heading">Evolving licensing models for blue chip NFT companies</h3>



Moonbirds has sparked a greater conversation about the pros and cons of different licensing models.&nbsp;



Each of the top NFT projects varies in its terms of service. Yuga Labs’ Bored Ape Yacht Club (BAYC), for example, grants holders unlimited commercial rights to use, copy and display the purchased art for the purpose of creating derivative works.



This allowed the founders of the Bored &amp; Hungry burger restaurant in California and the project Jenkins the Valet: The Writer&#8217;s Room to turn their Apes into the faces of their businesses.



One of the main advantages of owning an NFT is, arguably, the right to own the IP. However, building and marketing a brand from scratch is no walk in the park.&nbsp;



That’s where CC0 comes in. It lets other people do the building and marketing on behalf of an NFT holder.



The Nouns NFT project is an example of a popular CC0 collection, with plenty of derivative projects and merch made by non-holders that use Nouns IP.&nbsp;



Similar to open source software, when the IP is open, anyone can reuse, repurpose and distribute the NFT’s image.



The IP of Doodles NFTs, on the other hand, is company-owned. This model prevents individual NFT holders from monetizing their NFTs and instead allows community members to earn passive revenue via limited and non-exclusive access to NFT images.



Noodles, a collection created in homage to instant noodles, was Doodles’ first officially approved derivative project. Doodle holders can participate in the Doodles community treasury, known as the Doodlebank, and vote on how to use the funds for community experiences, collaborations and new projects.&nbsp;



<h3 class="wp-block-heading">CryptoPunks get new terms&nbsp;</h3>



CryptoPunks IP agreement was also company-owned until Monday. Larva Labs had originally retained the intellectual property rights to their creations, but since Yuga Labs acquired the IP of CryptoPunks and Meebits in March, the company foreshadowed BAYC-esque licensing rights.



<a href="https://cms.blockworks.co/tiffany-co-turns-cryptopunks-into-12-5m-luxury-jewelry-sale/" target="_blank" rel="noreferrer noopener">CryptoPunks’ first derivative project</a>, approved by but not officially affiliated with CryptoPunks, was the <a href="https://cms.blockworks.co/tiffanys-wants-cryptopunk-holders-to-buy-matching-bling-for-50k-eth/" target="_blank" rel="noreferrer noopener">Tiffany &amp; Co. NFTiff campaign</a> that let Punk owners manufacture their Punk into a physical pendant necklace for 30 ETH.  



Noah Davis, CryptoPunks’ brand lead, called the NFTiff project a “great illustration of what Punks are soon going to be able to do.”



When asked about his view on CC0, Davis said, “Not all projects were meant to be CC0 projects. It&#8217;s not a one size fits all thing.”&nbsp;&nbsp;



Both CryptoPunks and Meebits will now tie the IP rights to the NFTs. Meebits explained what these changes mean in a Twitter thread: “All Meebit IP rights will travel with whoever is the current owner, but allows for former owners to continue to use and profit off what they have already created and published.”



Yuga Labs does reserve the right to make further changes to the licensing terms, <a href="https://twitter.com/MeebitsNFTs/status/1553837379785482243" target="_blank" rel="noreferrer noopener">the thread said</a>.



“Don’t panic. This is there only because we are breaking new ground and need to be flexible in order to best serve the community,” it said.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

CryptoPunks

From Moonbirds to CryptoPunks, Terms of Service Are Changing

<div id="highlights-block_628f85197553a" class="highlights">
 <ul>
 <li>Asset Reality specializes in investigating, tracing and attempting to recover funds</li>
 <li>New service will pool data from a number of scam victims to help trace stolen assets</li>
 </ul>
 
</div>



ConsenSys’ self-custody wallet MetaMask is partnering with Asset Reality, a platform for accessing and recovering seized crypto and digital assets, to tackle cryptocurrency fraud. The two companies will support MetaMask scam and phishing victims in attempting to recover their assets.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">We’ve partnered with <a href="https://twitter.com/MetaMask?ref_src=twsrc%5Etfw">@metamask</a>! We’ll be helping victims of crypto-related fraud to recover their stolen digital assets in an industry-first approach to improving virtual asset recovery. Read more about this exciting new partnership: <a href="https://t.co/WBdRjWp1W0">https://t.co/WBdRjWp1W0</a><a href="https://twitter.com/ConsenSys?ref_src=twsrc%5Etfw">@Consensys</a> <a href="https://twitter.com/hashtag/crypto?src=hash&amp;ref_src=twsrc%5Etfw">#crypto</a>&mdash; Asset Reality | Techstars ‘21 🚀 (@asset_reality) <a href="https://twitter.com/asset_reality/status/1529809582868074496?ref_src=twsrc%5Etfw">May 26, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



The main security concerns for crypto wallet users are phishing scams that cast a wide net, as well as targeted spear-phishing attacks, according to MetaMask. Bad actors most commonly pose as a friendly face offering to help users navigate crypto’s technical jargon and trick users into handing over their funds.&nbsp;



MetaMask’s strategy is to pool information from a number of victims in the hope that it will help both identify the scammer and make recovering the stolen assets less costly. To use the service, victims must <a href="https://fund-loss-investigation.metamask.io/" target="_blank" rel="noreferrer noopener">submit a ticket</a> for investigation.



Some examples of recent attacks include a <a href="https://cms.blockworks.co/metamask-issues-warning-following-icloud-phishing-scam/" target="_blank" rel="noreferrer noopener">$650,000 phishing scam</a> of a MetaMask wallet user targeted by a hacker posing as an Apple employee. MetaMask’s response, which was criticized at the time by community members, was to issue a warning to users whose data were susceptible to hackers because their iCloud backups include their password-encrypted MetaMask vault.



Earlier this week, a Moonbirds NFT holder <a href="https://twitter.com/CirrusNFT/status/1529296043547865088?s=20&amp;t=RZ-rlCczPtsuuzlqXc70ug" target="_blank" rel="noreferrer noopener">lost</a> 29 of his Ethereum-based Moonbirds, worth around $1.5 million at the time, after signing a bad transaction on a fake trading site he reached by clicking a malicious link shared by a scammer. The victim was a member of the Proof Collective, a private group of 1,000 dedicated NFT (non-fungible token) collectors and artists. Although the scammer was <a href="https://twitter.com/knownasdollar/status/1529297355396489217?s=20&amp;t=MVMqcnyASCcJ24AUrlFiBg" target="_blank" rel="noreferrer noopener">identified</a>, only an FBI report was filed.&nbsp;



Harry Denley, an information technology security analyst at MetaMask, told Blockworks that bad actors are “simply taking advantage of a nascent industry where new users are generally optimistic, excited by the potentials, and not very experienced with having full control of such valuable assets.”



Cybercrime is a multi-billion dollar worldwide industry, he added, emphasizing the importance of hack victims coming forward, no matter how small the loss.&nbsp;



Traditional recovery, however, involves lengthy and often costly civil litigation, with no guarantee of recovering funds. According to MetaMask&#8217;s support product lead Alex Herman, digital asset recovery is difficult due to the cryptocurrency’s “pseudo-anonymous” and “immutable” nature. 



“While traditional systems opt for transactions to be reversible and accounts to be frozen, crypto has prioritized the control of the individual user and decentralized systems. Bad actors can also use obfuscation techniques to make it harder to track stolen funds,” Herman told Blockworks.&nbsp;



In the case of a scam, MetaMask will request any relevant information regarding phishing websites, vectors and funds lost, while Asset Reality will handle the case for MetaMask’s affected users. They will build an investigation into each scam operation and manage any communication with the users.



Along with recovery mechanisms in place, MetaMask and Asset Reality hope to protect users by expanding their education tools and offerings on their platform.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

Moonbirds

Newsletter

Blockworks Research