As far as I could find, there were only a few people talking about being hacked after receiving a gift NFT.ĭon’t sign things you haven’t read or don’t recognize OpenSea says in a statement that it hasn’t found any instances of someone actually carrying out that kind of attack - though it’s still unclear what happened to the people who say they were attacked. If you’re not paying attention or didn’t realize what was going on and confirmed the transfer, you could wind up losing everything in your wallet. If the target clicks yes, the attackers could snag the wallet’s information and trigger another popup asking to approve a transfer from the victim’s wallet to their own. For users with a crypto-wallet browser extension like MetaMask installed, it initiates a popup asking to connect to their wallet. The potentially dangerous situation occurs when viewing the image by itself (by, say, right-clicking on it and hitting “open in new tab”). The transfer confirmation message users may see while viewing an infected NFT. While being sent an NFT gift doesn’t require any interaction on your part, the malicious NFTs were harmless if they just sat unviewed in an OpenSea account.
While the attackers potentially being able to drain entire wallets is certainly not a good look for OpenSea, it wasn’t a simple matter of just gifting someone an NFT - the exploit needed its target to click on a few prompts first, including one that might include transaction details. The security firm says the NFT trading platform fixed the issue within an hour and worked with researchers to make sure the fix worked.
The researchers talked to one of the people saying they were attacked, and found vulnerabilities proving an attack could happen this way and reported the problems to OpenSea. The issue was found by security firm Check Point Research, which noticed tweets from people claiming they were hacked after being gifted NFTs, according to a blog post. OpenSea has fixed vulnerabilities in its platform that could’ve let hackers steal someone’s crypto after sending them a maliciously crafted NFT.
0 kommentar(er)
