Be wary of NFT security risks: Nine monkeys were stolen this morning by a big player

Odaily资深作者

2022-02-01 06:48

This article is about 1158 words, reading the full article takes about 2 minutes

The total amount stolen exceeds 600 ETH.

On February 1, a large Twitter account named larrylawliet.eth (also the ENS registered domain name of its holding wallet) tweeted that several Bored Ape Yacht Club, Mutant Ape (Mutant Ape Yacht Club), Doodles NFT was accidentally stolen, and I hope NFT trading platforms such as Opensea and LooksRare can help.

Opensea historical data shows that larrylawliet.eth transferred 10 high-value NFTs to the address 0xd27045a8506369a60a227b44beadb2aed2099d70 8 hours ago, including 4 pieces of BAYC (#1606, #9138, #4250, #7985), 5 pieces of MAYC (# 25971, #25970, #8464, #3770, #2499) and Doodles #6910.

According to the real-time floor prices of BAYC 118.68 ETH, MAYC 25.2 ETH, and Doodles 16.28 ETH, the total value of these stolen NFTs is about 617 ETH. However, considering that there are more rare models in these NFTs, such as lasers like BAYC #1606 Eye monkey, the total value of these NFTs is actually far more than that number.

At present, Opensea has issued a risk warning for this security incident. The address of larrylawliet.eth and related NFTs have been marked in red, and the account main interface of address 0xd27045 is no longer viewable.

Over the past period of time, the BUG about the sale of OpenSea at an abnormal price has aroused widespread concern in the industry. This bug will cause some high-value NFTs to be wrongly sold at past prices. For example, someone once listed a BAYC at a price of several thousand dollars in the past, and transferred it to another wallet without canceling the offer. When they transfer that NFT back to the previous order wallet, the past order will still trigger.

This BUG has caused many users to suffer losses in unexpected circumstances, and Opensea has also attracted a lot of criticism. However, the theft of larrylawliet.eth has nothing to do with Opensea.

According to larrylawliet.eth himself on Twitter, the immediate cause of the theft was,The discord of an NFT project called Moshi Mochi was previously hacked. The hacker posted a Mint link in the official channel. larrylawliet.eth minted a large number of NFTs through the fake link, but at the same time leaked their wallet privacy information .

As of posting, larrylawliet.eth is still appealing to those who have bought their own NFTs from hackers to contact him, it seems that they want to buy these NFTs back.

It is worth mentioning that after the theft, BAYC #9138 was bought by an address starting with 0x62bdc6 at a price of 100 ETH, and then transferred back to the larrylawliet.eth address through the transit address. At present, it is not clear who is performing this operation, but this behavior of placing assets in exposed addresses is obviously not a proper method.