New NFT private auction scam threatens OpenSea users

As non-fungible tokens (NFTs) have grown in popularity, malicious actors have become more active, constantly trying to exploit users in the space. A new hack related to the functionality of the NFT marketplace OpenSea is now threatening his NFT owner through a phishing site.

In the announcement, the anti-theft project Harpie warned New hacking NFT users, including gasless sales on the OpenSea platform. According to Harpie, hackers were able to exploit this feature to steal millions of digital assets.

If a user wishes to make a gasless sale within the OpenSea platform, they must approve a signature request containing an illegible message. This feature also allows users to create private auctions with illegible signatures.

Hackers were able to magically steal NFTs using a little-known OpenSea feature. This is the latest hack and millions of Apes have already been lost.

(1/4) pic.twitter.com/fTK20WQrgh

Harpy (@harpieio) December 22, 2022

Because of this, phishing websites have used this feature to ask victims to sign one of these unintelligible messages. According to Harpie, signatures often disguise the steps required to log in and access a website.

However, the login message is actually a signature request to privately sell the victim’s NFTs to scammers for 0 Ether (ETH). If signed, the NFT will be sent to the hacker’s wallet address.

Related: Web3 developers claim their projects would rather be hacked than pay a bounty

Apart from this scam, blockchain security firm CertiK also recently issued a warning to the cryptocurrency community about what it calls ice phishing. Through this exploit, the crook tricks her Web3 user into signing permissions, allowing the attacker to use the token. CertiK pointed out that this scam is a serious threat and unique to the Web3 world.

On December 17th, an analyst revealed that a crook claimed to have stolen 14 Bored Ape NFTs using a gasless Seaport signing facility. After executing his engineering from the ground up, the hacker lured the victim to his fake NFT platform and asked the owner to sign a contract. Following this, the victim’s wallet was emptied.