Over 7k SOL ($1.2M) got lost on Solana NFT mint due to a hack

https://blog.vanila.io/over-7-000-sol-1-2-946215a9ee0e?gi=9e0ce560928d

by jelenajjo • 5 years ago

88 105 5 years ago

blog.vanila.io

adoxyz2• 5 years ago

Oh no...anyway.

muttantt• 5 years ago

another "hack"...

ketzo• 5 years ago

At first glance, the "hack" looked to be a pretty basic phishing setup, but it seems like some kind of Discord functionality may have been compromised? That would be a pretty big deal.

shiohime7• 5 years ago

This is the thing that stands out most to me here - how did the phisher possibly post in the announcements channel?? This exploit seems like it could have further reaching impacts assuming the announcements channel and server roles / permissions was configured properly. Otherwise this is no different from like almost any other phishing attack since the beginning of time... .

belltaco• 5 years ago

The webhook URL to post to that channel got leaked outside of Discord, doesn't seem like a Discord exploit.

jmuguy• 5 years ago

I think a lot of bad actors in the crypto community are going after Discord setups. For instance a recent NPM watering hole attack downloaded a scanner that was looking for Discord related credentials and settings. This article mentions a webhook being compromised.

mgraczyk2• 5 years ago

I'd be willing to bet it's an opsec mistake by one of the mods. Somebody misplaced a device or got phished, or similar.

mosselman2• 5 years ago

So these people who lost 100k. Did they really lose 100k or did they lose crypto currency worth 100k, but which they purchased for a lot less?

What is 'minting' anyway?

Edit: I do understand that if you have something worth x you in essence lose x, but there is a big difference between these people buying this stuff for $2 2 years ago or investing $100k right now.

costcofries• 5 years ago

what does it matter, you buy a house for $500k and sell it for $900k a couple years later, same difference?

pcthrowaway• 5 years ago

Yes, or if you bought it for 40K but it burns down when valued at 800K, that loss is still effectively an 800K loss to you. Replacing it will cost the same.

arthur_sav• 5 years ago

A loss is a loss but it matters in terms of exposure for the individual.

If they took a loan or put all of their life savings into it then it feels a bit different than turning $50 into $500000.

encoderer• 5 years ago

Sounds like the difference is about $499,998

mosselman2• 5 years ago

It matters for context:

Lets say I bought a lottery ticket for $10 and my ticket wins and I can go pick up $200 million. On my way to the office of the lottery place I lose the ticket somehow, then I am not out $200 million, I just don't have it anymore, but it isn't as if suddenly I can't lead the same life as before I bought the ticket.

Lets now say that I just bought a huge number of toys for all of my life savings to sell in the holidays and then the uninsured warehouse where I stored them burned down, I actually lose all of my life savings and I have to sell the house, my car, lose the kids, etc.

I am not saying it doesn't suck, I am just trying to discover the context.

mgraczyk2• 5 years ago

Solana is highly liquid, so it makes absolutely no difference.

shiohime7• 5 years ago

Minting is just essentially purchasing something with a couple of extra steps behind the scene.

What pretty much happens when you are minting an NFT is:

1. The owner of the collection uses a program that controls everything around the NFT sales, like the start date, the price, the order of art that is distributed, the owners of the collection where the funds get transferred, and other settings.

This happens before users can mint.

2. User wants to buy art, they launch a webpage that interacts with the above program. They pay the amount of money that the art is configured to sale for, and the program will process these payments in the order they are received and distribute art based off of the order the art is to be distributed. The above program also has safeguards that prevent users from being charged in the case that the art is out of stock at the time the user attempts to pay for it.

3. The 'minting' process is taking the art that was configured from this program, creating (minting) a token for it, and creating any underlying token accounts that are needed to store the art in the user's wallet, and transferring ownership.

NOTE - there are definitely other ways to distribute NFTs, such as generative art that is created at the time of the transaction based off of the block hash. The above example is how this particular NFT collection was to be distributed, it's a common model used by probably the majority of NFT projects. The actual 'minting' step (#3) is pretty much the same though, the process of creating the token and associating the metadata and transferring ownership.

xapata2• 5 years ago

there is a big difference between these people buying this stuff for $2 2 years ago or investing $100k right now.

Rationally, there is not (assuming a liquid market). Emotionally, maybe.

xapata2• 5 years ago

Ah, except for capital gains taxes and other transaction costs.

timdaub• 5 years ago

Can we stop calling projects 'blue chip"? Thanks.

jmpman• 5 years ago

We should decriminalize theft of crypto anything. It will instantly destroy crypto currency.

jeremycarter• 5 years ago

The saddest violin music plays to mourn the loss of the cryptos.

tata717• 5 years ago

This is a pretty bad comment, so I'll take the opportunity to mention great trend: web3 means bug bounty programs are finally properly funded, and both webapp, communication, and cold storage security will absolutely flourish because of this.

adoxyz2• 5 years ago

how?

turminal2• 5 years ago

web3 means bug bounty programs are finally properly funded

Can you provide some reference? Doesn't seem very feasible to me.

throwhauser• 5 years ago

Just because things are funded doesn't mean they'll flourish.

dreyfan• 5 years ago

No SOL was lost, just a surprise wealth redistribution.

jshen2• 5 years ago

Code is law, and that’s a horrible idea.

tata717• 5 years ago

No, instead, law is interpreted like figure skating, or baton twirling, by a panel, chosen for the good of the people!

reustle• 5 years ago

I guess they are just SOL

godot• 5 years ago

This appears to be highly coordinated. From the article, it sounds like their Discord server has a channel (announcements) that should only be writable by admins, but some type of API keys were leaked before (could've been obtained a long time ago) and the attackers held on to it until now to post a phishing link around the time when minting was supposed to open. It seems like the attacker even made a precaution move of DDOS'ing the real web site to make sure people can't go to the real one which adds credibility. This is a pretty high level effort attack.

The weakest link here seems to be that Discord is the trusted source of truth of communication from the project (not unlike emails are the trusted channel to verify identity for individual users on many web services). What's not yet known is whether some Discord-side security is compromised or the project admins had previously been phished/social-engineered to expose their API keys in the past.

numbsafari• 5 years ago

Could have been an inside job by the admins, too.

secondcoming2• 5 years ago

That was my first thought

projct• 5 years ago

The key leak could just as easily be incompetence. Accidentally committed to git, or in their travis setup in such a way as to be easily obtainable, or a bunch of other options.

High effort for high reward like this is not surprising but it could all start with incompetence.

tomp2• 5 years ago

So you're implying that the money got stolen, not lost as the title of the post claims?

slowhand09• 5 years ago

One of the commmentors in the article: "Its important money to my family, my wife, my son." And you were willing to put it on a risky, highly speculative project, even if it wasn't a target for hacking.

jaywalk• 5 years ago

Hopefully he meant it would have been important money if it were cashed out, and he had actually bought it for next to nothing instead of buying it anywhere near what it's worth today.

tata717• 5 years ago

Degenerate speculation in cryptocurrency is responsible for the lackluster adoption by technologists in former years.

Here's hoping this is the peak — it seems to be, from my studies.

snayan• 5 years ago

He was willing to put some percentage of the 650SOL into the risky project, we don't know how much he intended to invest/gamble, but it seems doubtful to me that he intended to spend his whole wallet on it.

TylerE• 5 years ago

You can't feed your family with a shitcoin.

jchw• 5 years ago

It is worth also noting that it may not be wise to store your entire life savings in an experimental, possibly illegal alternate currency backed by a permissionless blockchain. Banks may be incompetent at times, but at least you have options. Lessons learned the hard way, but it’s not as if nobody was warning folks.

efficax• 5 years ago

Putting important funds in SOL, which isn't even a crypto anyone has ever heard of, is already a mistake

bprater• 5 years ago

From the article: "The website asked for permission from a Phantom wallet, and it actually drained all SOL from their wallet." It's possible that he didn't spend all his SOL on this project.

pjc502• 5 years ago

Everything in a crypto wallet is a high risk asset, even if you're an infosec professional.

nfa• 5 years ago

This is the ultimate, fundamental problem with the cryptocurrency market. People parrot "only invest what you can afford to lose" and end their moon-promises with "...not financial advice" as if their moon-promises would be worth typing if they sincerely believed that their audience will only invest what they can afford to lose.

Yes, the person who lost their money made a terrible, stupid mistake... but if you spend more than a moment in/around cryptocurrency projects, you will be sucked in to believing that _the old-world financial system is crumbling, the only way to secure your future is by investing everything into cryptocurrency_ and so "only invest what you can afford to lose" has an implied wink, "I'm only saying this because the old-world system will come for me if I don't!"

I have sympathy for the fool.

vmception5• 5 years ago

What do you mean, I check with my financial advisor before every NFT mint launches

pointyfence• 5 years ago

I feel bad for the wife and kid, but I don't have any sympathy for the person.

"I am always recommending people using burner but I was nervous and fomo the "Monkey Kingdom Mint. Never thought it was not a legit mint link in official discord."

Some people can't learn by theory. They have to learn by practice. FOMO isn't a mistake. That's just greed calling the shots.

The best way to learn how to control FOMO is to experience its consequences. The only question is how much tuition are you willing to pay. He paid a lot.

As the saying goes: Bulls make money. Bears make money. Pigs get slaughtered.

turminal2• 5 years ago

These things just keep happening, don't they?

jsiepkes• 5 years ago

Since minting such a big project is a race of fast fingers, a lot of people didn’t pay attention to what is going on.

Seems to me the thing that was exploited was one of the oldest things in existence to exploit: Human greed.

323• 5 years ago

No worries. Solana is so decentralized, they will be easily able to revert the steal transactions.

ascendantlogic• 5 years ago

Because this is crypto it gets the eyeballs but really this is just a successful phish. If it was "Wells Fargo users get accounts drained by targeted attack" it wouldn't get 25% of the views.

jshen2• 5 years ago

Really? I could be wrong, but I feel like it would be all over the news if Wells Fargo lost $1.2mil. Do you have examples of it happening and not getting press?

Ekaros5• 5 years ago

I wonder if they would even disclose losing 1,2 million or just hide it...

Dma54rhs• 5 years ago

Surely banks lose the same way tons of money for calling scams everywhere, it was good old phising scam + nft insanity greed. Often the call scams at least where I live make old people to wire their money because they think they talk with a banking clerk. In this case young people thought they were talking with some sort of nft/crypto influencer I guess.

theklub• 5 years ago

Well also Wells Fargo can usually reverse or refund the money. If you lose money in Crypro land I don't think you're getting it back.

moonbug• 5 years ago

any yet nothing of value was lost.

trident5000• 5 years ago

They should try turning the network on and off for the 3rd time.

calrueb• 5 years ago

They are going to "make things right" which sounds like they may refund members that fell for this. Would the 4D chess move be for the hacker to have "stolen" some of their own funds out of a different wallet to make it look like they were a victim? Then they can double dip, and claim the refund as well as walk away with the stolen goods.

vmception5• 5 years ago

Yes that’s possible.

They can even begin laundering the money by purchasing the coveted NFTs when the mint is relaunched, and selling them on the marketplaces

(This wont break the link of funds, alone, but at least they will have different money.

Much faster to bridge all the money to Ethereum network, swap it for Ether and deposit it into tornado cash. Launch a new token with already clean money they have from their day job salary, and pump that token with their dirty funds. And just sell the clean tokens into the pump. Now theyre just lucky founder or speculator.)

saturn5k2• 5 years ago

This whole space turned out to be one big joke. It's the wild west of scams, hacks, snake oil salesman, teenage influencers giving "expert" advice on trading, shilling scam coins, NFTs and what not..

I am following this space since 2015 as a bystander when Ethereum was founded. Currently this is the most spectacular shit-show on the planet. Especially now with all the NFT craze, I am seeing more and more celebrities getting sucked into this craze and trying to promote the next big thing.

I wonder when it's all going to pop and who is going to be left holding all the bags?

Ekaros5• 5 years ago

Reminds me. Does anyone know how those ICOs are doing now? How many of those is actually used for something productive?

mrgordon• 5 years ago

I thinks it’s safe to conclude not many. One of the more promising ones seemed to be EOS and even that went nowhere.

shiohime7• 5 years ago

It's not too much different than most other ventures, most failed, a couple have built out successful products.

jacquesm3• 5 years ago

teenage influencers giving "expert" advice on trading

But they're no worse than all of the 'analysts' that talk about the regular stock and option market. You could replace the bulk of those people with random number generators and you'd never know. Might even be an improvement.

saturn5k2• 5 years ago

It's the inevitable reality of social media, it gave the village idiot a megaphone.

vizzah• 5 years ago

Too many fools willing to part with their money. This new generation has not experienced enough financial fear to properly manage their financial risks. In additional social media is promoting rich and luxurious life styles, resulting even in those who can not afford to lose, gambling their life savings.

tomp2• 5 years ago

The website asked for permission from a Phantom wallet, and it actually drained all SOL from their wallet.

Does anyone else see this as a massive failure on Phantom wallet's part?

That's like my bank, when I pay online using a credit card, asking me to "confirm full access by merchant XYZ to your account" instead of "confirm payment of $50 to merchant XYZ". I mean, DeFi is supposed to be better than legacy institutions, right?!

mikestaszel• 5 years ago

Phantom by default requests approval before executing transactions, and shows a simulation (e.g. balance changes like this). This can be disabled in the advanced settings (or users can approve transactions without reading the approval popup...).

shiohime7• 5 years ago

This is true, but I think that they really should disable approving the transaction prior to the simulation finishing. Because right now, you can simply approve a transaction blindly without letting this complete and seeing the changes in your account balance, which is probably what the people who got their wallet drained did I'd assume, just blindly click purchase because they are in full FOMO mode for their ape NFT.

Ekaros5• 5 years ago

Who is even putting money into these? Or is this type of attack successful exactly because people want to be first to buy and then dump?

jacquesm3• 5 years ago

It's funny how every crypto coin and other novel financial trick has an automatic bug bounty tacked on and most of the users aren't even aware of it. The more successful something like this is the higher the probability that if there are any flaws that they will be found.

golemiprague• 5 years ago

I think this is exactly what solana needs to get some traction, it's a good PR move because now everybody will know about it and many people will go in because the price will go down temporarily due to the "hacking".

vmception5• 5 years ago

This is a phishing theft, not lost

As it is possible for cryptocurrency to be lost and unrecoverable by anyone, the distinction needs to be made

Someone made $1.2mm and there will be no investigation and the team will save face by a couple recompensation means

NelsonMinar• 5 years ago

Only a million bucks? That's nothing compared to the usual scams.

vmception5• 5 years ago

I think this should be called JIT Phishing

I think there are teams dedicated to doing this as I’ve seen it before several years back

MildlySerious• 5 years ago

Turns out the account of a team member of Grape - a provider for wallet verification between SOL and Discord - was compromised[1]. Grape was being used in other Discord servers also. fractal.is is another example with $150k in SOL stolen, but the team already confirmed they will be reimbursing all funds lost apparently. I wouldn't be surprised if there were more instances.

[1] https://twitter.com/grapeprotocol/status/1473422238250680320

Over 7k SOL ($1.2M) got lost on Solana NFT mint due to a hack

Related Stories