10 ms·

Over 7k SOL ($1.2M) got lost on Solana NFT mint due to a hack

88 points by jelenajjo 5y ago

jsiepkes 5y ago
> Since minting such a big project is a race of fast fingers, a lot of people didn’t pay attention to what is going on. Seems to me the thing that was exploited was one of the oldest things in existence to exploit: Human greed.
adoxyz 5y ago
Oh no...anyway.
muttantt 5y ago
another "hack"...
ketzo 5y ago
At first glance, the "hack" looked to be a pretty basic phishing setup, but it seems like some kind of Discord functionality may have been compromised? That would be a pretty big deal.
- shiohime 5y ago
  This is the thing that stands out most to me here - how did the phisher possibly post in the announcements channel?? This exploit seems like it could have further reaching impacts assuming the announcements channel and server roles / permissions was configured properly. Otherwise this is no different from like almost any other phishing attack since the beginning of time... .
  - belltaco 5y ago
    The webhook URL to post to that channel got leaked outside of Discord, doesn't seem like a Discord exploit.
    - shmatt 5y ago
      so simply that URL was worth about $1,000,000 I hope whoever sold it didn't undervalue their asset
- jmuguy 5y ago
  I think a lot of bad actors in the crypto community are going after Discord setups. For instance a recent NPM watering hole attack downloaded a scanner that was looking for Discord related credentials and settings. This article mentions a webhook being compromised.
- mgraczyk 5y ago
  I'd be willing to bet it's an opsec mistake by one of the mods. Somebody misplaced a device or got phished, or similar.
mosselman 5y ago
So these people who lost 100k. Did they really lose 100k or did they lose crypto currency worth 100k, but which they purchased for a lot less? What is 'minting' anyway? Edit: I do understand that if you have something worth x you in essence lose x, but there is a big difference between these people buying this stuff for $2 2 years ago or investing $100k right now.
- costcofries 5y ago
  what does it matter, you buy a house for $500k and sell it for $900k a couple years later, same difference?
  - pcthrowaway 5y ago
    Yes, or if you bought it for 40K but it burns down when valued at 800K, that loss is still effectively an 800K loss to you. Replacing it will cost the same.
    - dvt 5y ago
      This is not how things work at all. The wood and plaster and glass your house is made of doesn't go up in value, your land (aka deed) does. So if your house burns down, you did not, in fact, lose $800k.
      - shiohime 5y ago
        The materials already used in your house may not go up in value, but the value of the raw materials themselves certainly have gone up in value due to 30% inflation or whatever over the past year. Take a look at lumber prices. In this example I'm sure it wouldn't cost $800k to rebuild the house, but it'd certainly be more than $40k, so it would definitely be a loss.
    - meheleventyone 5y ago
      The cost to rebuild is often less than the cost of the house to buy these days.
timdaub 5y ago
Can we stop calling projects 'blue chip"? Thanks.
jmpman 5y ago
We should decriminalize theft of crypto anything. It will instantly destroy crypto currency.
- jeremycarter 5y ago
  The saddest violin music plays to mourn the loss of the cryptos.
- tata71 5y ago
  This is a pretty bad comment, so I'll take the opportunity to mention great trend: web3 means bug bounty programs are finally properly funded, and both webapp, communication, and cold storage security will absolutely flourish because of this.
  - adoxyz 5y ago
    how?
    - fouc 5y ago
      because the security engineers will be able to withdraw the funds out of any security hole and keep it for themselves as the bounty
  - turminal 5y ago
    > web3 means bug bounty programs are finally properly funded Can you provide some reference? Doesn't seem very feasible to me.
    - pjc50 5y ago
      If you can steal all the money, you generally get to keep it. Especially if you're in a jurisdiction that doesn't extradite to the west.
      - hermes8329 5y ago
dreyfan 5y ago
No SOL was lost, just a surprise wealth redistribution.
- jshen 5y ago
  Code is law, and that’s a horrible idea.
  - tata71 5y ago
    No, instead, law is interpreted like figure skating, or baton twirling, by a panel, chosen for the good of the people!
- reustle 5y ago
  I guess they are just SOL
godot 5y ago
This appears to be highly coordinated. From the article, it sounds like their Discord server has a channel (announcements) that should only be writable by admins, but some type of API keys were leaked before (could've been obtained a long time ago) and the attackers held on to it until now to post a phishing link around the time when minting was supposed to open. It seems like the attacker even made a precaution move of DDOS'ing the real web site to make sure people can't go to the real one which adds credibility. This is a pretty high level effort attack. The weakest link here seems to be that Discord is the trusted source of truth of communication from the project (not unlike emails are the trusted channel to verify identity for individual users on many web services). What's not yet known is whether some Discord-side security is compromised or the project admins had previously been phished/social-engineered to expose their API keys in the past.
- tomp 5y ago
  So you're implying that the money got stolen, not lost as the title of the post claims?
- numbsafari 5y ago
  Could have been an inside job by the admins, too.
  - secondcoming 5y ago
    That was my first thought
- projct 5y ago
  The key leak could just as easily be incompetence. Accidentally committed to git, or in their travis setup in such a way as to be easily obtainable, or a bunch of other options. High effort for high reward like this is not surprising but it could all start with incompetence.
yob28 5y ago
slowhand09 5y ago
One of the commmentors in the article: "Its important money to my family, my wife, my son." And you were willing to put it on a risky, highly speculative project, even if it wasn't a target for hacking.
- jaywalk 5y ago
  Hopefully he meant it would have been important money if it were cashed out, and he had actually bought it for next to nothing instead of buying it anywhere near what it's worth today.
  - tata71 5y ago
    Degenerate speculation in cryptocurrency is responsible for the lackluster adoption by technologists in former years. Here's hoping this is the peak — it seems to be, from my studies.
    - cinntaile 5y ago
      From your studies?
      - tata71 5y ago
        Yes, you read that and wrote it back down correctly. Is there a query, or would you like a chocolate chip raisin for being so good?
        cinntaile 5y ago
        Well what kind of studies did you conduct and how did they help you reach your conclusion, don't leave us hanging like that?
    - dvt 5y ago
      > Here's hoping this is the peak — it seems to be, from my studies. Until the Fed gets inflation under control (2-3 quarters, if not more), we'll still see plenty of retail money go into risky speculative instruments. Alchemy just raised a ton of money, OpenSea just raised a ton of money, YGG just raised a ton of money, Nike just acquired RTFKT, Ubisoft is doing gaming skins as NFTs. Why do you think this is the peak?
turminal 5y ago
These things just keep happening, don't they?
323 5y ago
No worries. Solana is so decentralized, they will be easily able to revert the steal transactions.
ascendantlogic 5y ago
Because this is crypto it gets the eyeballs but really this is just a successful phish. If it was "Wells Fargo users get accounts drained by targeted attack" it wouldn't get 25% of the views.
- jshen 5y ago
  Really? I could be wrong, but I feel like it would be all over the news if Wells Fargo lost $1.2mil. Do you have examples of it happening and not getting press?
  - Dma54rhs 5y ago
    Surely banks lose the same way tons of money for calling scams everywhere, it was good old phising scam + nft insanity greed. Often the call scams at least where I live make old people to wire their money because they think they talk with a banking clerk. In this case young people thought they were talking with some sort of nft/crypto influencer I guess.
  - Ekaros 5y ago
    I wonder if they would even disclose losing 1,2 million or just hide it...
    - nrb 5y ago
      In that case, luckily we have the CFPB to get to the bottom of it.
    - BoorishBears 5y ago
      Maybe just hide it by silently making everyone whole? If someone from the project wants to do that I don't think anyone will complain?
  - deleted 5y ago
    [deleted]
- theklub 5y ago
  Well also Wells Fargo can usually reverse or refund the money. If you lose money in Crypro land I don't think you're getting it back.
moonbug 5y ago
any yet nothing of value was lost.
trident5000 5y ago
They should try turning the network on and off for the 3rd time.
calrueb 5y ago
They are going to "make things right" which sounds like they may refund members that fell for this. Would the 4D chess move be for the hacker to have "stolen" some of their own funds out of a different wallet to make it look like they were a victim? Then they can double dip, and claim the refund as well as walk away with the stolen goods.
- vmception 5y ago
  Yes that’s possible. They can even begin laundering the money by purchasing the coveted NFTs when the mint is relaunched, and selling them on the marketplaces (This wont break the link of funds, alone, but at least they will have different money. Much faster to bridge all the money to Ethereum network, swap it for Ether and deposit it into tornado cash. Launch a new token with already clean money they have from their day job salary, and pump that token with their dirty funds. And just sell the clean tokens into the pump. Now theyre just lucky founder or speculator.)
deleted 5y ago
[deleted]
saturn5k 5y ago
This whole space turned out to be one big joke. It's the wild west of scams, hacks, snake oil salesman, teenage influencers giving "expert" advice on trading, shilling scam coins, NFTs and what not.. I am following this space since 2015 as a bystander when Ethereum was founded. Currently this is the most spectacular shit-show on the planet. Especially now with all the NFT craze, I am seeing more and more celebrities getting sucked into this craze and trying to promote the next big thing. I wonder when it's all going to pop and who is going to be left holding all the bags?
- Ekaros 5y ago
  Reminds me. Does anyone know how those ICOs are doing now? How many of those is actually used for something productive?
  - shiohime 5y ago
    It's not too much different than most other ventures, most failed, a couple have built out successful products.
  - mrgordon 5y ago
    I thinks it’s safe to conclude not many. One of the more promising ones seemed to be EOS and even that went nowhere.
    - robcohen 5y ago
      Even at the time, EOS didn't look great. The technicals just weren't there for the protocol. It was joked to be the AWS of blockchains -- ie. essentially centralized, same with Ripple. It was definitely not the most promising. I would argue that most of blockchain is still in its early infancy. Only very recently has second layer stuff really begun to scale reasonably well. Once Eth 2 comes out and scaleability takes off I think we'll see a huge amount of growth. Right now we're in the 1200 baud dialup phase connecting to a BBS that costs $2 per minute to use. It's not practical yet for 98% of applications. It will be, and I think within 1-2 years.
tomp 5y ago
> The website asked for permission from a Phantom wallet, and it actually drained all SOL from their wallet. Does anyone else see this as a massive failure on Phantom wallet's part? That's like my bank, when I pay online using a credit card, asking me to "confirm full access by merchant XYZ to your account" instead of "confirm payment of $50 to merchant XYZ". I mean, DeFi is supposed to be better than legacy institutions, right?!
- mikestaszel 5y ago
  Phantom by default requests approval before executing transactions, and shows a simulation (e.g. balance changes like this). This can be disabled in the advanced settings (or users can approve transactions without reading the approval popup...).
  - shiohime 5y ago
    This is true, but I think that they really should disable approving the transaction prior to the simulation finishing. Because right now, you can simply approve a transaction blindly without letting this complete and seeing the changes in your account balance, which is probably what the people who got their wallet drained did I'd assume, just blindly click purchase because they are in full FOMO mode for their ape NFT.
Ekaros 5y ago
Who is even putting money into these? Or is this type of attack successful exactly because people want to be first to buy and then dump?
jacquesm 5y ago
It's funny how every crypto coin and other novel financial trick has an automatic bug bounty tacked on and most of the users aren't even aware of it. The more successful something like this is the higher the probability that if there are any flaws that they will be found.
golemiprague 5y ago
I think this is exactly what solana needs to get some traction, it's a good PR move because now everybody will know about it and many people will go in because the price will go down temporarily due to the "hacking".
vmception 5y ago
This is a phishing theft, not lost As it is possible for cryptocurrency to be lost and unrecoverable by anyone, the distinction needs to be made Someone made $1.2mm and there will be no investigation and the team will save face by a couple recompensation means
NelsonMinar 5y ago
Only a million bucks? That's nothing compared to the usual scams.
vmception 5y ago
I think this should be called JIT Phishing I think there are teams dedicated to doing this as I’ve seen it before several years back
MildlySerious 5y ago
Turns out the account of a team member of Grape - a provider for wallet verification between SOL and Discord - was compromised[1]. Grape was being used in other Discord servers also. fractal.is is another example with $150k in SOL stolen, but the team already confirmed they will be reimbursing all funds lost apparently. I wouldn't be surprised if there were more instances. [1] https://twitter.com/grapeprotocol/status/1473422238250680320 https://twitter.com/grapeprotocol/status/1473422238250680320

88 points by jelenajjo 5y ago

> Since minting such a big project is a race of fast fingers, a lot of people didn’t pay attention to what is going on. Seems to me the thing that was exploited was one of the oldest things in existence to exploit: Human greed.

adoxyz 5y ago

Oh no...anyway.

muttantt 5y ago

another "hack"...

ketzo 5y ago

At first glance, the "hack" looked to be a pretty basic phishing setup, but it seems like some kind of Discord functionality may have been compromised? That would be a pretty big deal.

shiohime 5y ago
This is the thing that stands out most to me here - how did the phisher possibly post in the announcements channel?? This exploit seems like it could have further reaching impacts assuming the announcements channel and server roles / permissions was configured properly. Otherwise this is no different from like almost any other phishing attack since the beginning of time... .
- belltaco 5y ago
  The webhook URL to post to that channel got leaked outside of Discord, doesn't seem like a Discord exploit.
  - shmatt 5y ago
    so simply that URL was worth about $1,000,000 I hope whoever sold it didn't undervalue their asset
jmuguy 5y ago
I think a lot of bad actors in the crypto community are going after Discord setups. For instance a recent NPM watering hole attack downloaded a scanner that was looking for Discord related credentials and settings. This article mentions a webhook being compromised.
mgraczyk 5y ago
I'd be willing to bet it's an opsec mistake by one of the mods. Somebody misplaced a device or got phished, or similar.

mosselman 5y ago

So these people who lost 100k. Did they really lose 100k or did they lose crypto currency worth 100k, but which they purchased for a lot less? What is 'minting' anyway? Edit: I do understand that if you have something worth x you in essence lose x, but there is a big difference between these people buying this stuff for $2 2 years ago or investing $100k right now.

costcofries 5y ago
what does it matter, you buy a house for $500k and sell it for $900k a couple years later, same difference?
- pcthrowaway 5y ago
  Yes, or if you bought it for 40K but it burns down when valued at 800K, that loss is still effectively an 800K loss to you. Replacing it will cost the same.
  - dvt 5y ago
    This is not how things work at all. The wood and plaster and glass your house is made of doesn't go up in value, your land (aka deed) does. So if your house burns down, you did not, in fact, lose $800k.
    - shiohime 5y ago
      The materials already used in your house may not go up in value, but the value of the raw materials themselves certainly have gone up in value due to 30% inflation or whatever over the past year. Take a look at lumber prices. In this example I'm sure it wouldn't cost $800k to rebuild the house, but it'd certainly be more than $40k, so it would definitely be a loss.
  - meheleventyone 5y ago
    The cost to rebuild is often less than the cost of the house to buy these days.

timdaub 5y ago

Can we stop calling projects 'blue chip"? Thanks.

jmpman 5y ago

We should decriminalize theft of crypto anything. It will instantly destroy crypto currency.

jeremycarter 5y ago
The saddest violin music plays to mourn the loss of the cryptos.
tata71 5y ago
This is a pretty bad comment, so I'll take the opportunity to mention great trend: web3 means bug bounty programs are finally properly funded, and both webapp, communication, and cold storage security will absolutely flourish because of this.
- adoxyz 5y ago
  how?
  - fouc 5y ago
    because the security engineers will be able to withdraw the funds out of any security hole and keep it for themselves as the bounty
- turminal 5y ago
  > web3 means bug bounty programs are finally properly funded Can you provide some reference? Doesn't seem very feasible to me.
  - pjc50 5y ago
    If you can steal all the money, you generally get to keep it. Especially if you're in a jurisdiction that doesn't extradite to the west.
    - hermes8329 5y ago

dreyfan 5y ago

No SOL was lost, just a surprise wealth redistribution.

jshen 5y ago
Code is law, and that’s a horrible idea.
- tata71 5y ago
  No, instead, law is interpreted like figure skating, or baton twirling, by a panel, chosen for the good of the people!
reustle 5y ago
I guess they are just SOL

godot 5y ago

This appears to be highly coordinated. From the article, it sounds like their Discord server has a channel (announcements) that should only be writable by admins, but some type of API keys were leaked before (could've been obtained a long time ago) and the attackers held on to it until now to post a phishing link around the time when minting was supposed to open. It seems like the attacker even made a precaution move of DDOS'ing the real web site to make sure people can't go to the real one which adds credibility. This is a pretty high level effort attack. The weakest link here seems to be that Discord is the trusted source of truth of communication from the project (not unlike emails are the trusted channel to verify identity for individual users on many web services). What's not yet known is whether some Discord-side security is compromised or the project admins had previously been phished/social-engineered to expose their API keys in the past.

tomp 5y ago
So you're implying that the money got stolen, not lost as the title of the post claims?
numbsafari 5y ago
Could have been an inside job by the admins, too.
- secondcoming 5y ago
  That was my first thought
projct 5y ago
The key leak could just as easily be incompetence. Accidentally committed to git, or in their travis setup in such a way as to be easily obtainable, or a bunch of other options. High effort for high reward like this is not surprising but it could all start with incompetence.

yob28 5y ago

slowhand09 5y ago

One of the commmentors in the article: "Its important money to my family, my wife, my son." And you were willing to put it on a risky, highly speculative project, even if it wasn't a target for hacking.

jaywalk 5y ago
Hopefully he meant it would have been important money if it were cashed out, and he had actually bought it for next to nothing instead of buying it anywhere near what it's worth today.
- tata71 5y ago
  Degenerate speculation in cryptocurrency is responsible for the lackluster adoption by technologists in former years. Here's hoping this is the peak — it seems to be, from my studies.
  - cinntaile 5y ago
    From your studies?
    - tata71 5y ago
      Yes, you read that and wrote it back down correctly. Is there a query, or would you like a chocolate chip raisin for being so good?
      - cinntaile 5y ago
        Well what kind of studies did you conduct and how did they help you reach your conclusion, don't leave us hanging like that?
  - dvt 5y ago
    > Here's hoping this is the peak — it seems to be, from my studies. Until the Fed gets inflation under control (2-3 quarters, if not more), we'll still see plenty of retail money go into risky speculative instruments. Alchemy just raised a ton of money, OpenSea just raised a ton of money, YGG just raised a ton of money, Nike just acquired RTFKT, Ubisoft is doing gaming skins as NFTs. Why do you think this is the peak?

turminal 5y ago

These things just keep happening, don't they?

323 5y ago

No worries. Solana is so decentralized, they will be easily able to revert the steal transactions.

ascendantlogic 5y ago

Because this is crypto it gets the eyeballs but really this is just a successful phish. If it was "Wells Fargo users get accounts drained by targeted attack" it wouldn't get 25% of the views.

jshen 5y ago
Really? I could be wrong, but I feel like it would be all over the news if Wells Fargo lost $1.2mil. Do you have examples of it happening and not getting press?
- Dma54rhs 5y ago
  Surely banks lose the same way tons of money for calling scams everywhere, it was good old phising scam + nft insanity greed. Often the call scams at least where I live make old people to wire their money because they think they talk with a banking clerk. In this case young people thought they were talking with some sort of nft/crypto influencer I guess.
- Ekaros 5y ago
  I wonder if they would even disclose losing 1,2 million or just hide it...
  - nrb 5y ago
    In that case, luckily we have the CFPB to get to the bottom of it.
  - BoorishBears 5y ago
    Maybe just hide it by silently making everyone whole? If someone from the project wants to do that I don't think anyone will complain?
- deleted 5y ago
  [deleted]
theklub 5y ago
Well also Wells Fargo can usually reverse or refund the money. If you lose money in Crypro land I don't think you're getting it back.

moonbug 5y ago

any yet nothing of value was lost.

trident5000 5y ago

They should try turning the network on and off for the 3rd time.

calrueb 5y ago

They are going to "make things right" which sounds like they may refund members that fell for this. Would the 4D chess move be for the hacker to have "stolen" some of their own funds out of a different wallet to make it look like they were a victim? Then they can double dip, and claim the refund as well as walk away with the stolen goods.

vmception 5y ago
Yes that’s possible. They can even begin laundering the money by purchasing the coveted NFTs when the mint is relaunched, and selling them on the marketplaces (This wont break the link of funds, alone, but at least they will have different money. Much faster to bridge all the money to Ethereum network, swap it for Ether and deposit it into tornado cash. Launch a new token with already clean money they have from their day job salary, and pump that token with their dirty funds. And just sell the clean tokens into the pump. Now theyre just lucky founder or speculator.)

deleted 5y ago

[deleted]

saturn5k 5y ago

This whole space turned out to be one big joke. It's the wild west of scams, hacks, snake oil salesman, teenage influencers giving "expert" advice on trading, shilling scam coins, NFTs and what not.. I am following this space since 2015 as a bystander when Ethereum was founded. Currently this is the most spectacular shit-show on the planet. Especially now with all the NFT craze, I am seeing more and more celebrities getting sucked into this craze and trying to promote the next big thing. I wonder when it's all going to pop and who is going to be left holding all the bags?

Ekaros 5y ago
Reminds me. Does anyone know how those ICOs are doing now? How many of those is actually used for something productive?
- shiohime 5y ago
  It's not too much different than most other ventures, most failed, a couple have built out successful products.
- mrgordon 5y ago
  I thinks it’s safe to conclude not many. One of the more promising ones seemed to be EOS and even that went nowhere.
  - robcohen 5y ago
    Even at the time, EOS didn't look great. The technicals just weren't there for the protocol. It was joked to be the AWS of blockchains -- ie. essentially centralized, same with Ripple. It was definitely not the most promising. I would argue that most of blockchain is still in its early infancy. Only very recently has second layer stuff really begun to scale reasonably well. Once Eth 2 comes out and scaleability takes off I think we'll see a huge amount of growth. Right now we're in the 1200 baud dialup phase connecting to a BBS that costs $2 per minute to use. It's not practical yet for 98% of applications. It will be, and I think within 1-2 years.

tomp 5y ago

> The website asked for permission from a Phantom wallet, and it actually drained all SOL from their wallet. Does anyone else see this as a massive failure on Phantom wallet's part? That's like my bank, when I pay online using a credit card, asking me to "confirm full access by merchant XYZ to your account" instead of "confirm payment of $50 to merchant XYZ". I mean, DeFi is supposed to be better than legacy institutions, right?!

mikestaszel 5y ago
Phantom by default requests approval before executing transactions, and shows a simulation (e.g. balance changes like this). This can be disabled in the advanced settings (or users can approve transactions without reading the approval popup...).
- shiohime 5y ago
  This is true, but I think that they really should disable approving the transaction prior to the simulation finishing. Because right now, you can simply approve a transaction blindly without letting this complete and seeing the changes in your account balance, which is probably what the people who got their wallet drained did I'd assume, just blindly click purchase because they are in full FOMO mode for their ape NFT.

Ekaros 5y ago

Who is even putting money into these? Or is this type of attack successful exactly because people want to be first to buy and then dump?

jacquesm 5y ago

It's funny how every crypto coin and other novel financial trick has an automatic bug bounty tacked on and most of the users aren't even aware of it. The more successful something like this is the higher the probability that if there are any flaws that they will be found.

golemiprague 5y ago

I think this is exactly what solana needs to get some traction, it's a good PR move because now everybody will know about it and many people will go in because the price will go down temporarily due to the "hacking".

vmception 5y ago

This is a phishing theft, not lost As it is possible for cryptocurrency to be lost and unrecoverable by anyone, the distinction needs to be made Someone made $1.2mm and there will be no investigation and the team will save face by a couple recompensation means

NelsonMinar 5y ago

Only a million bucks? That's nothing compared to the usual scams.

vmception 5y ago

I think this should be called JIT Phishing I think there are teams dedicated to doing this as I’ve seen it before several years back

MildlySerious 5y ago

Turns out the account of a team member of Grape - a provider for wallet verification between SOL and Discord - was compromised[1]. Grape was being used in other Discord servers also. fractal.is is another example with $150k in SOL stolen, but the team already confirmed they will be reimbursing all funds lost apparently. I wouldn't be surprised if there were more instances. [1] https://twitter.com/grapeprotocol/status/1473422238250680320 https://twitter.com/grapeprotocol/status/1473422238250680320