OpenSea, the largest NFT marketplace in existence, is under constant threat from notorious cyber actors. A new type of scam threatens OpenSea visitors who offer “gasless sales” on the platform and eventually redirect victims to phishing sites. Based on blockchain technology, NFTs are digital collectibles that have financial value and could also be used in metaverses. Web3 scammers are known to have infiltrated the NFT sector to generate huge profits from a single theft.
Harpie, the anti-theft platform, has issued a warning about this ongoing scam to warn the group about OpenSea visitorsearch for NFTs as well as buyers and sellers.
OpenSea has a function to do gasless sales where NFT seller can exempt their buyers from paying the platform fees by doing it themselves.
As part of the reportedly ongoing scam, hackers trick people into signing an unreadable message. Gasless NFTs are likely to attract signature requests from first-time buyers.
Users can also set up private auctions with custom prices using those unreadable signatures required to approve gasless transactions.
“phishing Websites will ask victims to sign a harmless-looking “login signature” in order to access their website. But that login signature is actually a request to sell your NFT for 0 ETH to the hacker’s address,” Harpie wrote in a Twitter post.
The platform also claimed that several “monkey” NFTs recently may be from the Bored Apes Yacht Club Collection was stolen from OpenSea.
Hackers were able to magically steal NFTs using a little-known OpenSea feature. It’s the latest hack, and several million apes have already been lost.
(:thread:1/4) pic.twitter.com/fTK20WQrgh
— Harpie (@harpieio) December 22, 2022
The exact number of stolen NFTs or affected users remains unknown.
Until now, OpenSea has not addressed Harpie’s concerns.
However, this is not the first time OpenSea has faced a hacking threat.
At least 32 users of OpenSea in February lost their holdings worth US$1.7 million (approx. Rs.12.5 billion) for a phishing attack. The company claimed at the time that the attack came from outside the website, where attackers lured users with malicious agreements.
OpenSea decided to do so in August involve police officers in cases of theft of all magnitudes and not only in cases with escalated disputes.
The change aimed to ensure users are protected from the risk of accidentally purchasing stolen digital collectibles.
