Over the past few weeks, several cases of lost crypto wallets have been reported and tweeted on social media platforms. Users have been complaining about zero balance in their crypto wallets; a result of accepting a gift on the OpenSea marketplace.
Taking the lead from these tweets, Check Point researchers investigated the OpenSea platform to discover the vulnerability. The investigation revealed a critical security vulnerability, which, if exploited, allows hackers to hijack user accounts and steal crypto wallets by enticing them through malicious free non-fungible tokens (NFTs).
OpenSea is a peer-to-peer digital marketplace for crypto collectibles and NFTs. It is a platform to buy and sell exclusive digital assets. OpenSea recorded $3.4 billion in transaction volume in August 2021 and has grown to be one of the largest marketplaces for NFT of the crypto world.
Keep vigilant
I had $90,000 worth of tokens stolen from my @MetaMask @BinanceChain wallet
Unsure how this has happened but it’s incredibly disappointing
One thing I hate are thieves 🤬
They are scum 😡
I hope you die a slow painful death when your time comes 💯
R.I.P
— The Crypto King (@microman2020) October 5, 2021
They still have not responded to multiple phishing abuse emails sent 4 days ago @GoDaddyHelp . They don’t care that dozens of people’s crypto wallets are stolen. @GoDaddy @beefyfinance
— Can (@resmihesabi) October 7, 2021
Are we sure this is fixed? I’m still watching accounts have stolen NFTs transfered and sold. Most hacked user addresses are flagged and frozen but the same wallet receiving/selling is still going?
Be careful out there.@opensea #NFTs #NFT #opensea
https://t.co/oAQkZ91IyT— MoonBaboon (@M00nbab00n) October 14, 2021
Exploitation Explained
The security vulnerability on the OpenSea platform allows the hacker to create a malicious NFT and send it as a gift to the target victim.
On viewing the malicious NFT, a pop-up is activated from the storage domain, asking for a connection to the target’s cryptocurrency wallet. Not suspecting the pop-up, the victim clicks to connect their wallet to claim the gift (NFT), allowing the hacker access to the user wallet.
An additional pop-up describing the transaction is triggered, which is also sent from OpenSea’s storage domain. Once the user clicks it without noticing the message, the hacker can steal the entire cryptocurrency wallet. The victims fall prey easily as any action — even liking an art in the system — on the platform requires a wallet sign-in. These messages evade suspicion as these are frequent system notices, which users are accustomed to while operating on these platforms.
Check Point researchers informed OpenSea of their findings, and both the groups have collaborated to address the issue. OpenSea came up with a solution, though it claims to have not identified any case where the attackers have cheated their customers.
Advisory
OpenSea released an advisory to protect its users against the threat, stating the following:
- While signing wallet actions is required to take certain actions on OpenSea, you should always be careful when receiving requests to sign a transaction with your wallet online. Before you approve a request for your signature, you should carefully review what is being requested and consider whether the request is abnormal or suspicious. If you have any doubts, you should reject the request.
- Check if the signature request correlates with an expected action.
- Users should note that OpenSea does not request wallet signatures for viewing or clicking third-party photos or links. Such activity is highly suspicious, and users should not sign transactions that are unrelated to the specific actions on OpenSea.
The crypto market is largely an unorganized sector without stringent policies and regulations in place. This makes it an attractive target for cyberattacks. As these marketplaces were created to enhance the financial sector, countries are viewing them more as a bane than a boon.
China had issued a blanket ban on all crypto transactions and mining to further its crackdown and root out all illegal cryptocurrency activity from its country. Many countries are taking preventive measures to curb the security challenges arising from the DeFi markets.
Also Read:
U.S. DoJ Launches Civil Cyber-Fraud and Cryptocurrency Initiatives
