Researchers have uncovered how critical vulnerabilities in the OpenSea marketplace allowed crypto thefts via malicious NFT uploads.
OpenSea Allowing Malicious NFT
Check Point Research team has shared details about a malicious crypto-stealing campaign in the wild. As discovered, the threat actors exploit critical vulnerabilities in the OpenSea marketplace to upload malicious non-fungible tokens (NFT).
Elaborating the details in a report, the researchers said they were curious about the matter after noticing warning alerts regarding crypto theft via airdropped NFTs on OpenSea.
If you’ve been getting airdropped random NFTs, DO NOT TOUCH THEM. People have been getting hacked. #nft #NFTCommunity #opensea #metamask
— Serial For Breakfast (@serial4bkfst) September 20, 2021
And that wasn’t the only case since many other users also complained.
Guys, I just got hacked bad. They wiped my ledger. Impersonators on the OpenSea discord impersonating @natechastain and others. Wiped 4.5 ETH and all of my apes and cats. Fuck.
— jeffnicholas.eth ??✨ (@_jeffnicholas_) August 24, 2021
Investigating the matter allowed them find out about the ongoing campaign that involved uploading malicious NFTs. This would then allow the hackers to steal crypto assets from target users’ digital wallets.
All of this happened by exploiting the vulnerabilities in the OpenSea platform. As standard, signing up on OpenSea lets the users allow their wallets to communicate with their accounts for any subsequent actions, including those that don’t require a transaction.
That’s where the problem exists. Once the target user opens a gifted malicious NFT, the embedded code would execute to trick the user into allowing access to the account. This would then let the hacker retrieve the target users’ wallet address and balance. After that, the final step involves the transference of the “art” where the user would inadvertently allow the popup notifications apparently from the wallet to lose their assets to the hackers unknowingly.
The following video demonstrates the PoC.
Bugs Fixed
Following this discovery, Check Point Research responsibly disclosed the vulnerabilities to OpenSea, which then fixed them to prevent malicious NFT.
So, while the users are now, Check Point Research further warns the users to remain wary of suspicious transactions.
Users should note that OpenSea does not request wallet approval for viewing or clicking third-party links. Such activity is highly suspicious and users should not interact with wallet approvals that are unrelated to OpenSea specific actions such as buying, making an offer, liking an image.
Besides, it urges the users to double-check requests for signing their wallets online.
Before you approve a request; you should carefully review what is being requested and consider whether the request is abnormal or suspicious. If you have any doubts, you should reject the request and examine further before providing such authorization.
Let us know your thoughts in the comments.
