Learning Objectives:

• Master NFT security best practices

• Understand common attack vectors and their explanations

• Learn about wallet security and seed phrase protection

• Analyze real-world NFT hacks and lessons learned

---

6.4.1: The Security Landscape

Why NFTs are Targeted:

NFTs often have high value, and transactions are irreversible. Once an NFT is stolen, there is no central authority to reverse the transaction or recover the asset. This makes NFT theft particularly damaging and attractive to attackers.

The pseudonymous nature of blockchain means attackers can operate with relative anonymity, making it difficult to identify or prosecute them. This emboldens malicious actors and makes the ecosystem a target for sophisticated attacks.

Common Attack Vectors:

Phishing Attacks are the most common and often the most effective attack vector. Attackers create convincing fake websites, send fraudulent emails, or pose as trusted individuals to trick users into revealing their credentials or signing malicious transactions. Phishing attacks exploit human psychology rather than technical vulnerabilities.

The most common phishing scenario involves a fake marketplace or minting site. The attacker creates a website that looks identical to a legitimate site, complete with similar logos, design, and content. When users connect their wallet and try to mint or purchase NFTs, the fake site captures their credentials or signs malicious transactions.

Smart Contract Exploits target vulnerabilities in the code of NFT contracts or marketplaces. These can be complex to execute but can result in the loss of all NFTs in a collection if successful. Smart contract exploits often require sophisticated technical knowledge and are typically executed by experienced attackers.

Social Engineering Attacks manipulate individuals into revealing sensitive information or taking actions that compromise their security. This can involve impersonating support staff, creating fake urgency, or exploiting trust relationships.

6.4.2: Phishing Attacks – The Most Common Threat

How Phishing Works:

Phishing attacks typically follow a pattern designed to exploit human psychology and trust.

The attacker creates a convincing fake website or email that mimics a legitimate service. They may use similar domain names (like “opensea.com“ vs “opensea.io“) or identical design and content.

The attacker directs the victim to the fake site through email, social media, or compromised links. They may claim there is an urgent issue with the victim’s account or offer a limited-time opportunity.

Once on the fake site, the victim is asked to connect their wallet or provide sensitive information. The fake site captures this information or signs transactions that transfer assets to the attacker.

Preventing Phishing Attacks:

Always verify the URL of any site you visit. Use bookmarks for trusted sites and avoid clicking links from unsolicited messages. Check the domain name carefully for slight variations.

Never share your seed phrase with anyone. Legitimate services will never ask for your seed phrase. Any request for your seed phrase is a scam.

Use hardware wallets for high-value assets. Hardware wallets require physical confirmation for each transaction, making it much harder for attackers to steal your assets even if you accidentally connect to a fake site.

6.4.3: Wallet Security – Complete Guide

Hardware Wallets:

Hardware wallets are physical devices that store private keys offline. They provide the highest level of security because keys never leave the device, making them immune to online attacks.

When you sign a transaction with a hardware wallet, the transaction details are displayed on the device’s screen for physical confirmation. This ensures you know exactly what you are signing before it is broadcast.

Seed Phrase Protection:

The seed phrase is the most critical piece of information for any wallet. It can regenerate all private keys and access all assets. Losing the seed phrase means losing access to everything, while someone else gaining it means they can steal everything.

Never store seed phrases digitally. Do not take screenshots, store in cloud services, or type into any computer. Write the words on physical paper or metal and store securely in multiple locations.

Software Wallet Best Practices:

Keep your software wallet updated with the latest security patches. Use strong, unique passwords and enable two-factor authentication when available.

Be cautious about which dApps you connect to. Review the permissions you grant and revoke them when no longer needed.

Token Approvals:

Many marketplaces require token approvals to transfer your NFTs. These approvals allow the marketplace to manage your assets on your behalf.

Review and revoke token approvals regularly. Many tools like revoke.cash can help you manage and revoke approvals.

6.4.4: Real-World NFT Hacks

Case Study 1: Bored Ape Yacht Club Discord Hack (2022)

In April 2022, the Bored Ape Yacht Club Discord server was compromised. The attackers posted a fake minting link that led to a phishing site. Users who connected their wallets and attempted to mint were instead signing transactions that transferred their NFTs to the attackers.

Thirty-three Bored Ape Yacht Club NFTs were stolen, worth millions of dollars. The attack exploited trust in the official Discord channel and human psychology rather than any technical vulnerability.

Lessons Learned: Never click links in Discord, even in official channels. Always verify the source of any minting link or opportunity.

Case Study 2: OpenSea Vulnerability (2022)

In January 2022, a vulnerability in OpenSea’s listing contract was exploited. Attackers were able to buy NFTs at old, expired listing prices. The vulnerability allowed attackers to make offers on NFTs that had been listed at lower prices months earlier and then canceled.

Over 300 NFTs were stolen, worth millions of dollars. OpenSea later refunded the affected users.

Lessons Learned: Cancel all listings after any changes to your wallet or the marketplace. Use revoke.cash to remove unnecessary approvals.

6.4.5: NFT Safety Checklist

Pre-Purchase Safety:

Research the project thoroughly. Check the team’s background and reputation. Verify the smart contract address and audit reports. Assess the community’s sentiment and activity.

During Purchase:

Use a hardware wallet for high-value purchases. Verify the transaction details on your device screen before signing. Check the recipient address and amount carefully. Be wary of “too good to be true” prices.

Post-Purchase:

Store your NFTs in a secure wallet. Review and revoke token approvals regularly. Keep your seed phrase secure and backed up. Stay informed about security threats and best practices.

Emergency Response:

If you suspect your wallet has been compromised, move your assets to a new wallet immediately. Revoke all token approvals. Contact the relevant platforms and services to report the incident.

---