Kevin Rose loses $1.1 million in NFTs

It is understood that Rose’s NFTs were drained after he approved a malicious signature that transferred a significant proportion of his NFT assets to the exploiter

The co-founder of the nonfungible token (NFT) collection Moonbirds, Kevin Rose, has fallen victim to a phishing scam leading to over $1.1 million worth of his personal nonfungible tokens stolen.

The news was shared by the PROOF co-founder with his 1.6 million Twitter followers on January 25, asking them to avoid buying any Squiggles NFTs until his team managed to get them flagged as stolen.

Thank you for all the kind, supportive words. Full debrief coming, he then shared in another tweet around two hours later.

It is understood that Rose’s nonfungible tokens were drained after he approved a malicious signature that transferred a considerable part of his NFT assets to the exploiter.

According to an independent analysis by Arkham, the exploiter extracted at least one Autoglyph, which has a floor price of 345 ETH; 25 Art Blocks worth at least 332.5 ETH; and nine OnChainMonkey items, worth at least 7.2 Ether.

In total, at least 684.7 ETH ($1.1 million) was extracted.

Arran Schlosberg, the vice president of PROOF — the company behind Moonbirds — explained to his Twitter followers that Rose ‘was phished into signing a malicious signature’ which the exploiter used to transfer a large number of tokens.

In a post on January 25, crypto analyst ‘foobar’ further elaborated on the ‘technical aspect of the hack’, explaining that Rose approved an OpenSea marketplace contract to move all of his nonfungible tokens whenever Rose signed transactions.

The crypto analyst added that Rose was always ‘one malicious signature’ away from an exploit.

The crypto analyst said Rose should have instead been ‘siloing’ his nonfungible token assets in another wallet: Moving assets from your vault to a separate ‘selling’ wallet before listing on nonfungible token marketplaces will prevent this.

‘Quit,’ another on-chain analyst, told his followers on Twitter that the malicious signature was enabled by the Seaport marketplace contract — the platform which powers OpenSea.

According to Quit, a phishing site set up by the exploiters was able to view the NFT assets held by Rose in his wallet.

Then the exploiter set up an order to transfer all of Rose’s assets that are approved on OpenSea to themselves.

The malicious transaction was then validated by Rose, noted Quit.

Meanwhile, foobar noted that most of the stolen assets were well above the floor price, which puts the amount stolen at $2 million.

Quit urged that OpenSea users ‘need to run away’ from any other website that prompts them to sign something that looks suspicious.

On-chain analyst ZachXBT shared a transaction map to his Twitter followers which showed that the exploiter sent the assets to crypto currency exchange FixedFloat on the Bitcoin layer 2 Lightning Network.

The exploiter then traded the funds into BTC and deposited the BTC into a Bitcoin mixer.

Meanwhile, Ryan Sean Adams, the founder of Bankless, was enraged with the ease at which Rose was able to be exploited. In a tweet on January 25, Adams urged front-end engineers to improve user experience to prevent such scams from taking place.