NFT God Hack: How Did it Happen and How You Could Protect Yourself
Time flies, and we have arrived in 2023. It has already been a year since the crypto market went bear. The NFT market was pretty dead last year, with trading volume plummeting by 99%. Even the so-called blue-chip projects had a tough time and went into silence mode. But they had already built strong brands, IPs, and images during the hype season, and now they’re figuring out how to move forward.
On the other hand, NFT holders have struggles, too, as trading NFTs are no longer profitable now that the hype has died down. Some have been able to build up their profile and make money off their fame in the space, especially those who have made a ton of money from their NFT investments, either through strategies or sheer luck.
We’re constantly surrounded by internet scams, cyberattacks, and threats, especially when people let their guard down. This is what happened with the NFT influencer whose entire crypto wallet was drained by malware, bringing security awareness back into the spotlight.
Entire Crypto Wallet? For Real?!
The pseudo-anonymous influencers known as “NFT God” tweeted about how his digital livelihood was attacked on January 14, including his crypto wallet and multiple online accounts.
The tragedy went down this way: he accidentally clicked on a Google Ads link for some open-source video streaming software he was looking for, and it ended up downloading malware onto his computer. Instead of going to the official website, he clicked on a sponsored ad. Hours later, a series of phishing tweets were posted by attackers on two of his Twitter accounts. He realized he’d downloaded the wrong software.
The nightmare didn’t end there. NFT God returned home and got a notification that his crypto wallet had been hacked. The day after, his Substack account sent out phishing emails to all 16,000 of his followers.
Blockchain data reveals that around 19 Ether, including a Mutant Ape Yacht Club (MAYC) NFT, was stolen from his wallet. The attacker shuffled the ETH through several wallets and then sent it off to FixedFlat, a decentralized exchange, to then swap it for some other crypto.
The mistake that led to the wallet hack was when he set up his hardware wallet as a hot wallet by entering its seed phrase in a way that left it exposed online, and that’s how the hackers got their hands on his crypto and NFTs.
A small slip-up in the setup process resulted in a huge disaster, and here we would like to remind you again how we should keep our funds safe.
Can you protect yourself from hacks?
No matter how much NFTs go down in price, some hold a lot of sentimental value. It’s not just about avoiding financial losses but also protecting the memories and experiences that come with your collection.
Unlike phone scams, NFT scams and phishing links are way easier for scammers to set up. It’s like they’re laying out traps on the web, just waiting for someone to fall for them, like what happened in this case.
KOLs, even as famous and influential as NFT God, can still get into trouble and lose their assets due to security blunders. This case just goes to show that even the most famous KOLs aren’t invincible to careless mistakes, just like everyone else.
You can keep your assets safe if you’re careful in your Web3 journey. The top 2 advice: don’t click on sketchy links. Also, keep your seed phrase to yourself and in a safe place.
How should a cold wallet be used?
Firstly, what is a cold wallet?
A cold wallet is a form of cryptocurrency storage that operates entirely offline. Cold wallets are designed to keep private keys and other valuable pieces of data on an offline device, such as a USB drive or specialized hardware wallet. Using a cold wallet, users can keep their digital currencies safely secured against theft and losses due to computer viruses or hackers. The most significant advantage of using a cold wallet is that information can’t be digitally stolen from an offline source — providing extreme security for your crypto assets.
In the use of a cold wallet, when a new wallet is created with the cold wallet device, the private key and seed phrases remain in the offline environment, where they won’t be exposed to online conditions. As NFT God set up his hardware wallet as a hot wallet by entering the seed phrases, the credentials are no longer “cold” as they are operated online.
The cold wallet might be less convenient to use than a hot wallet. Still, it’s much safer as it is hard for attackers to steal seed phrases or private keys if they never appeared in the online environment. Thus, storing digital assets and currencies not regularly used in the cold wallet is a viable option.
How to prevent phishing links and malware?
There are several ways to prevent phishing links and malware.
- Look for official links for websites and software. The case we talked about today was due to downloading wanted software on the website by clicking google ads websites. Remember only to choose official and correct websites, prevent downloading malware, inputting your personal information, and allow access to your computer. Users can confirm the website by looking into other sources, such as the website links in different social media accounts, to ensure the web address.
- Refrain from being greedy to trust the message’s advantages and rewards. Only click links if you can confirm the sources. The attacker, in this case, uses NFT God’s Twitter and Substacks to send out phishing links to his followers and subscribers. It might be hard for users to identify if it is true, as all sources are covered with phishing content. Usually, these phishing messages include tempting wordings to bait users. So don’t let your greed put your assets in danger.
- Separate your workstations. Still, there are chances that we mistakenly click on phishing links, as people would make mistakes. And one practice to prevent this is to separate your crypto and typical Internet surfing workstation. Have a separate computer to operate your digital assets and another for regular Internet practices. Even if you click any links, your seed phrases and private keys in the hot wallet won’t be stolen as they are on a different device. If not able to have a separate device, using other web browsers like Brave Browser for crypto activities would be a better option, as these web3 browsers have better security measures.
Final thoughts
Even though the market’s been bearish and traders and speculators aren’t as active, scammers and attackers are still out there looking for their next target. We should make security a priority in our daily lives and be mindful of the decisions we make. That way, when the market turns bullish, we’ll be better prepared to handle the losses that can come with it.
