OpenSea Stalls Planned Upgrade As Phishing Attack Targets NFT Migration

OpenSea, a major nonfungible token (NFT) marketplace, has reportedly fallen victim to a phishing attack just hours after announcing a week-long planned upgrade to delist inactive NFTs on the platform.

OpenSea announced a smart contract upgrade yesterday, requiring users to migrate their listed NFTs from the Ethereum (ETH) blockchain to a new smart contract.

As a result of the upgrade, users who do not migrate from Ethereum risk losing their old, inactive listings — which currently do not require any gas fees for migration.

However, because of the urgency and short deadline, hackers had a brief window of opportunity.

What Happened After The Upgrade Announcement:

Within hours of OpenSea’s upgrade announcement, various sources began reporting on an ongoing attack against the soon-to-be-delisted NFTs.

RELATED: OPENSEA SMART CONTRACT UPGRADE TO DELIST INACTIVE NFTS ON ETHEREUM

Further analysis indicated that the NFTs were stolen using phishing emails before being moved to OpenSea’s new smart contract.

The attackers acquire access to the NFTs after a user allows the migration via the bogus email.

We are actively investigating rumors of an exploit associated with OpenSea related smart contracts. This appears to be a phishing attack originating outside of OpenSea's website. Do not click links outside of https://t.co/3qvMZjxmDB.

— OpenSea (@opensea) February 20, 2022

Users should be skeptical of all emails from OpenSea and revoke all rights related to the migration to the new smart contract.

Devin Finzer, co-founder and CEO of OpenSea, confirmed that 32 users have lost NFTs as a result of the phishing attack.

While the NFT marketplace has yet to decipher the ongoing phishing campaign.

Blockchain investigator Peckshield suspects a possible loss of user data (including email addresses) that is fueling the ongoing phishing attack.

Finzer, on the other hand, has asked impacted users to contact the corporation, as he concluded:

“If you are concerned and want to protect yourself, you can un-approve access to your NFT collection.”

RELATED: NFT FRAUD: UK TAX AUTHORITY MAKES FIRST SEIZURE IN £1.4M VAT SCAM

Three NFTs were seized by Her Majesty’s Revenue and Customs (HMRC), the UK’s principal tax department, in connection with a suspected tax evasion scheme.

According to iexclusivenews, the suspects built 250 bogus “shell” firms and utilized fictitious identities to escape 1.4 million British pounds (approximately $1.8 million) in value-added taxes.s.