The recently launched non-fungiable token (NFT) project “Rare Bears” was hacked after a hacker stole approximately $800,000 by posting a phishing link on the project’s Discord channel. In the attack, The Sandbox (SAND), Azuki, CloneX NFTs were stolen. Here are the details…
Rare Bears hacked: SAND, Azuki, CloneX converted to ETH
Blockchain security firm Peckshield’s analysis shows that the attacker has recovered 179 NFTs including “Rare Bears” and detailed that he stole other NFTs from various collections, including “CloneX”, “Azuki” from artist Sartoshi. In addition, six LAND tokens used for The Sandbox (SAND) metaverse were also stolen. According to the on-chain analysis, most of the NFTs have been sold and the hacker has captured 286 Ethereum (ETH). Most of these were immediately transferred to Tornado Cash, a crypto mixer used to hide the source of funds.
Earlier today, the “Rare Bears” team announced that their Discord reported that they have hired security consultant and auditor Pandez for a full security audit. According to an update posted by the “Rare Bears” team, the hacker gained access to the account of a Rare Bears Discord moderator known as Zhodan and posted an announcement that a new NFT mint is taking place on the group’s channel. The link was fake.
Discord channel secured
An update from the security audit has detected that the project head’s Discord account has been compromised. Using the hacked account, the attacker removed other mods. Thus, the published phishing link could not be deleted by other authorities. The attacker then invited a bot that locked down all channels on the server, removing the ability for others to publicly communicate that posts and links were fake. Rare Bears announced that the team regained control of the server, removing the compromised account. As we have also reported as
Kriptokoin.com, similar phishing scams have taken place on Discord in recent months. Last November, Discord members of popular NFT artist Beeple were also scammed, with attackers gaining access to a moderator’s account to post a phishing link. Similarly, user funds were stolen.
33648
