OpenSea Loses $1.7 Million to Phishing Attack

CEO Devin Finzer denies claims that the marketplace suffered a breached codebase and that hackers stole up to $200 million.

Phishing Attack

OpenSea, the world’s largest NFT marketplace, disclosed that it was hit by a phishing attack. The platform made the revelation in a tweet posted on Sunday, adding that the attack was no longer active.

We are actively investigating rumors of an exploit associated with OpenSea related smart contracts. This appears to be a phishing attack originating outside of OpenSea's website. Do not click links outside of https://t.co/3qvMZjxmDB.

— OpenSea (@opensea) February 20, 2022

Finzer also confirmed the attack on his Twitter account on the same day. According to the chief executive, it had no links to the website.

“It appears 32 users thus far have signed a malicious payload from an attacker, and some of their NFTs were stolen,” he wrote. However, the marketplace’s official Twitter account has since narrowed down the number of victims to 17.

NFTs, or non-fungible tokens, are unique, digitally transferable digital assets established on blockchain technology. Because they are unique, NFT owners cannot interchange their assets as is the case with fiat currency or other cryptocurrencies like Bitcoin.

$200 Million Stolen?

Just before the disclosure by the NFT marketplace, a Twitter user, Mr. Whale, alleged that “over $200m” was lost to the hacker.

BREAKING: Massive Opensea “exploit” in their new migration contract allowed users to sell, steal any NFT from any users.

Over $200M lost already.

— Mr. Whale (@CryptoWhale) February 20, 2022

Another user called Jacob King countered the claims of a phishing attack. He posted what he considered evidence of one of the “largest NFT exploits” ever.

#OpenSea is now lying and claiming the exploit was actually just phishing emails people were receiving.

This is 100% not true, but rather a flaw in their code which led to one of the largest #NFT exploits in history. pic.twitter.com/qGRq0MaFT1

— Jacob King (@JacobOracle) February 20, 2022

But Devin Finzer dismissed the rumor. According to him, the attacker only had $1.7 million in Ethereum after selling some of the stolen NFTs.