Following a series of viral tweets from panicked NFT traders, leading marketplace OpenSea clarified that it was investigating the so-called phishing hack. The attack occurred during OpenSea’s migration to its new Wyvern smart contract system, which began on Friday and is set to be completed by Feb. 25.
Around 10:50 p.m. ET, OpenSea CEO Devin Finzer followed up in a tweet that '32 users thus far have signed a malicious payload from an attacker, and some of their NFTs were stolen,' adding that the company is 'not aware of any recent phishing emails that have been sent to users,' suggesting a fraudulent website may be to blame.
OpenSea had planned to revise its smart contract by releasing a brand-new contract on Friday. The upgraded contract was intended to ensure old, inactive listings on the platform would eventually expire. What was initially thought to be official OpenSea emails about the migration process, the same email was one of the possible sources for the phishing hack.
The apparent attacker’s address currently holds about 641 ETH worth over $1.7 million which includes NFTs from the Bored Ape Yacht Club, two Cool Cats, one Doodle, and one Azuki.