Discord hackers steal millions of dollars worth of NFTs
Hackers have seized NFTs worth several million dollars through fraudulent actions on Discord.
Hackers have seized NFTs worth several million dollars through fraudulent actions on Discord. The number of phishing attacks on the social platform has recently increased.
Discord isn’t just a popular place to swap ideas—hackers are increasingly targeting certain servers with one goal: stealing valuable NFTs. The losses are now in the millions. New analyses point to a link between the phishing attacks.
For $22 million in NFTs stolen
The social media platform Discord has seen a rise in hacking incidents over the past three months. This is the result of a TRM Labs evaluation by the blockchain security firm TRM Labs. The common method: so-called phishing, where users are redirected to fraudulent websites and personal data is siphoned off. Hackers appear to be increasingly targeting valuable NFTs.
Phishing attacks tied to NFT theft rose 55 percent in June, according to TRM Labs. More than 100 reports of hacks on Discord channels have been reported to the company in the last two months. The NFT losses since May total about $22 million USD.
Target: Bored Ape Yacht Club
The attackers are taking a targeted approach and stealing mainly expensive NFTs, such as those from the Bored Ape Yacht Club (BAYC). On June 4, Yuga Labs’ Discord server—the company behind the NFT collection—was the target of several phishing attacks. Users were promised exclusive giveaways. After they clicked the links and connected their wallets, the attackers moved the NFTs to their own wallets.
In total, 32 NFTs, including Bored Apes and Otherside NFTs, were stolen valued at 140 Ether. A month earlier, a similar attack occurred via the Bored Ape Yacht Club’s Instagram account.
The same pattern
The attacks aren’t isolated, but follow a pattern, according to TRM Labs. Analyses of on- and off-chain data show that "many of the Discord attacks on NFT projects exhibit similar behavioral patterns." It includes phishing attacks on accounts of NFT projects Bubbleworld, Parallel, Lacoste, Tasties, Anata and "a dozen others". The June 4 incident on Yuga Labs’ Discord server would also be part of the orchestrated wave of attacks.
"We’ve seen an uptick in attacks on NFT projects and other crypto companies over the past months," said Ari Redbord, head of Legal at TRM Labs. "Such incidents could continue to rise as long as cybercriminals can steal large sums or assets that can be sold for cash."
Tracing on the blockchain
The pattern is the same: attackers create fraudulent accounts, pose as admins, push promotions such as giveaways, supposedly free NFT distributions, and send phishing links. They urge users to act fast to avoid missing a free NFT or a limited supply.
The stolen NFTs were initially sold on Ether marketplaces, according to TRM Labs. The majority of the proceeds were moved to three different wallets before the funds were moved to more wallets via the Ethereum mixer Tornado Cash. Through decentralized services, gambling sites, and a dark web market, the Ether is then swapped for Bitcoin. One of the three wallets was also linked to wallets directly tied to other Discord fraud tied to events in May and June 2022, according to TRM Labs.
Who or how many people were behind the attacks remains unclear. The professional approach suggests several factors that could be part of a hacker group.
