Hackers are actively stealing and flipping high-valued NFTs from users on OpenSea, the world’s largest NFT exchange, causing chaos and confusion in the broader NFT community.
OpenSea placed a red banner at the top of its site Saturday night saying “We are actively investigating rumors of an exploit associated with OpenSea related smart contracts. This appears to be a phishing attack originating outside of OpenSea’s website. Do not click links outside of opensea.io.”
OpenSea is currently requiring users who list NFTs on the site to upgrade to a new smart contract that fixes an issue with inactive listings that was allowing scammers to swipe valuable NFTs from collectors on OpenSea for dirt cheap. Some high profile NFT users are speculating now that a malicious actor is phishing people with a fake page designed to look like the one used to upgrade to that contract.
OpenSea did not immediately respond to a request for comment. A discussion about the hacks on Twitter Spaces had more than 3,700 listeners Saturday night.
There are indications that the hacker is giving some of their ill-gotten goods back. In one instance, the hacker stole numerous NFTs from one user including one valuable BAYC NFT. The hacker returned all the NFTs except the BAYC, which is currently frozen on OpenSea. The attacker’s page on the marketplace similarly 404s.