Bitcoin Forum

Source: https://twitter.com/punk9059/status/1736003743123132878

Honestly, I really felt what the victims have felt today in this massive hack. Their Christmas is ruined while the hackers are celebrating theirs in advance.

Those who have interacted with NFT Trader platform and have forgotten to revoke access before this incident happened were most likely got drained with those highly valuable NFTs.

Web3 still has long ways to go in terms of security. So far it's the most important of all the blockchain trilemmas that needs to be addressed seriously and for years it still has vulnerabilities.

This is truly heartbreaking indeed for us to see these highly valuable NFTs being compromised and drained by the hackers.

As security measures were in place, it seems that the hackers are just one step ahead countering that roadblock and bypassed it.

I wanted to ask what they are stealing an NFT for and I forgot that it has value, pardon me NFT lovers ;D. I’m imagining if it was Bored ape that was stolen too, haha! Anyways, is there a sense in stealing such things if you won’t be selling it? Now that brings me to the question; people know an NFT has been stolen, people know which exactly has been stolen, so, who dares to buy a stolen NFT because there’s no sense in that. Unlike normal crypto tokens/coins, no one can tell your ETH from the other ETH. But this? what would they use it for?

Interacting with smart contracts EVM compatible chains seems to be pretty dangerous lately, and revoking permissions after interacting with any contract should be a security standard at the very list.

What I also don't understand is why someone would continue keeping their valuable assets in a hot wallet instead of moving it to a cold wallet if they are not trading it? Creating an address does not cost any penny.

Yeah, there's still a long way to go with web3 and these vulnerabilities should be taken into account. I feel sorry for those folks who have their NFTs as their investment and have gone in an instant because of these hackers. There's no way to take them but will these platforms wherever they will be sold could do the same as what stolen cryptos can, and that's to block the addresses so that they won't be sold and the hackers won't be able to dispose and use them?

I am also wondering about this, when it comes to NFTs since each token is unique it should be impossible to obscure its tracks and anyone that may want to buy it will know it was stolen and that such token could be tracked back to them, so what kind of value those NFTs could hold? This is different than what we see with regular paintings and other forms of art that are stolen, because even if the art community also knows which pieces have been stolen, a transaction that is completely anonymous can take place and no one will know who has that piece of art on their possession.

That's the same question I had.  You can send crypto through a mixer and even if you don't it takes decent analytics to get caught up.  Nfts are unique and they have to be known as stolen, what's the point except to troll someone and steal theor stuff only to never use or sell it?  Am I missing something here?

thats what usually happens when someone just approve anything coming up their metamask or any wallet without trying to understand what they are doing, definitely, revoking approval would be viable way to stop this but to be frank, if you are trying to connect with some dapps, always try to revoke your wallet from any approval every week or so just to prevent any strange activity even better if everytime you interacted you revoke.
even though I agree that there are still many vulnerabilities with the way we interact with smart contract too many loophole, scammers are so eager to take advantage of the exploit for the sake of steaing other people money.
even you can't really trust any dapps that requires approval to do something with your token or NFT, and revoking my address has always been my routine after interacting with defi for the sake of safety of my money.
but to be honest, there should be no such thing like approval of our assets being used by smart contract, but unfortunately almost all of the defi out there use this mechanism, moreover, also, its gonna be better if wallet lke metamask trying to explain whats the smart contract function we gonna execute gonna do.

A good question to ponder on, because if a scammer is smart enough to hack NFT, surely he'll not be dumb to know that it can be traced. Perhaps it was an ingenious act to prove that there's a flaw in the system, so it's developers can go to work. The crypto space is facing a lot of challenges regarding frequent hacks and these is a worrisome trend, that'll surely reduce investors trust in crypto related investments. Everytime we're hearing one exchange or wallet being hacked, I really hope that we'll pass these unpalatable phase in the crypto space.

That is the question everyone asks whenever they see a big hack and the answer is within the question. They forget that hot wallets are prone to hacking and big amounts should be kept in cold wallets for long-term hold and security. Unfortunately, only a handful follow this simple rule and those who do not, have to suffer loss due to such hacks because of their carelessness.

If it was bid cheaper than floor then bots can bought it or some are probably not aware of the hacked. Or possibly some have bid offer to it and got accepted even though its not on their prefered price. If you are hacker then you thinking to liquidate it as much as possible its not like you hold them and wait for it to go up. So nfts being stolen are probably gonna drop in price. Im thinking high level nft like bored ape, and many more.

Definitely, these hackers already know how to liquidate such stolen NFTs.
Because if they are not seeing any value on this, why would they go such route of stealing?
Maybe they already got their bidder on this. Or better yet, they are just testing their hacking capabilities.
And more than likely, they have already next in mind which one will be their next target victim.

I don’t mean that it can be tracked in the sense of knowing who is the owner at the time but it is unique and outstanding. So, if you steal it, even if no one knows who stole it, they know that the NFT which is for sale is stolen. And no one would want to buy it because they will be seen as a bad person for intentionally buying a stolen item. And there’s no sense in buying it in secret when NFTs are mostly flaunted by the owner.

It is not just the NFT community that has a long way to go, including the entire crypto market that has a lots to be adjusted and defined for these hackers to have low efforts to be able to steal what belongs to others. There had been so many news before now of hackers looking for ways to steal for websites that have low security impleted to ensure users fund. We need to make sure that we are careful about the way we connect our wallets to many of these wwb3 or cryptocurrency decentralized exchanges.

I do not think anything can be done other than people being more cautious and careful of their funds. There will always be hackers no matter what happens or how good things were economically. Do you not know that some people do it for fun? One of the biggest hacks that happened this year or last, where the hacker returned some of the money, he said he was only trying to show that the security was weak but had no intentions to actually steal. So, brace up, keep your wallet address safe; as safe as possible.

Yeah but each nft is unique so if it was tagged as stolen it would be very easy to see and most trading platforms can just flag it.  I'm not huge into the nft world but I would imagine that this would also open the doors to track down the people who stole it.  Just seems dumb to hack nfts unless it's just for the lols

Well, Hackers are all over the internet and they are just waiting for a good opportunity to penetrate their actions. They don't have any remorse for their victims because they look at them as their prey. That's why we really need to exert all efforts to secure our crypto assets in order to prevent this kind of scenario from happening to us. We need to keep ourselves updated because those hackers always come up with new strategies to fool people and they always make some new baits to lure their victims and make them believe they are still safe.

It's really sad to see how much pain it caused to the owners. It's really hard to fathom what they are thinking about now. It's because of a trade in the past and having them permitted to trade using that NFT Trader thing has caused that. A lot of people do bad things because of the financial incentives. It's a shame.

What could've been done to prevent it? I read that not permitting traders or connectors would be the safest option or something.

Sad news of the week. All wallet having high price nft and holding large amount should always check wallet permission and revoke unnecessary permission. This 10 minutes gives to safety precautions step will save you from forever big loss. The nft mentioned in tweet are the most worthy nfts such as Mayc, blur and no one could bear loss in this way. BTW we should be careful with our wallet safety aa such kind of incident will completely drop our portfolio in no time.

The amount of web3 hacks I have seen makes me think that I am doing a good thing not investing into anything like that at the moment. I just get coins that I like and I keep them stored carefully and that's all that ı do, I do not do anything else. I get that sometimes it may feel like it is not an easy task to not go for big, and some people want to do something crazy to make some insane returns, but this isn't it for me. Ape that worths 300k+ and more? That sounds unreal to me, the fact that what was stolen is considered millions of dollars when I wouldn't even pay ten bucks for most of them, is insane.

People are overvaluing all these things and then it turns and hurts them instead. I think instead of going for these things and finding a better security, the better deal would be just not going for it all together and they would do a lot better on the long term. It would not be all that much of a big deal, and they would just avoid something terrible anyway.

No. It isn’t even about these platforms flagging or tagging it as stolen. Let’s say they don’t even tag it, but then, there’s a big news that this NFT was stolen. Like in this case, OP said millions of dollars. How is it possible that someone sees the news that this item is stolen (though the platform doesn’t flag it and it can be traded well), and still buy it? I don’t know who will do such because when they buy it, it’s still stolen and the chances of selling it out should be slimmer. Reputation too; which ever millionaire or billionaire that buys it will be looked at as a bad person.

If I am not wrong stolen NFTs are harder to cashout than coins and other tokens so with good tracing analytical team it possible to identify the address and somehow it is possible to link the individual with the known address if they ever came into contact with any kyced platform and also NFT marketplace should blacklist those address which makes it impossible for the hacker to do anything further.

Crypo curency makes transactions very easy in the hands of digital, blockchain progress presents NFT assets that are much easier, I mean in terms of quantity that is only a finger count but worth a lot of money. I know bored ape in the nft telegram channel at a price that I can't imagine, because the actual nft artwork in terms of price is so awake, I bought only a few nfts, even though the cex event did not participate in an nft project to buy. Even if i am get it, it's just a gift.

I agree, that even revoke /ekt I don't think all crypto users know or use it, especially the nft that I know is not evenly distributed around me in the sense that it is not as popular as crypto coins because nft is a hobby and collection, i hope there is a nft rekt/revoke website for the future.

I do not justify crime, but the activity of people surfing the internet until it becomes a necessity is a gap, among which not revoking permission after interacting with certain dex is also a supporter. in the past, crypto coins were not as familiar as they are now, now there are no rekt websites for certain chains, what I have encountered is still around famous coins such as bnb, eth, matic, usdt etc., over time maybe there will be, there is no safe gap in the internet world but by continuing to be vigilant there will be efforts to minimize the crime gap.

The NFTs were stolen from a trading platform. Even if you no longer want to trade it, once you've approved the contract's permissions, moving it to a cold wallet won't help until you revoke permission. Revoking will cost gas which is expensive and you have to do it for every contract you've interacted with. The high gas fees are not worth it to most people. There is also the fact that the revoke.cash website was compromised by the Ledger Connect Kit library vulnerability.

You are right that security is really important in the Web3 space. Even though blockchain technology has improved  there are still weaknesses that hackers can interfere easily. It is a constant challenge to keep your securities strong and make sure users things are safe.
Platforms and developers need to make security a top priority. They should invest in strong measures to protect users money and things. If a platform can't give good security and don't have ability to fight the hackers so they should close the platform or even must have the reserve funds for users if they affected by hackers.

some people might just really be bored and way too talented in terms of hacking they might just really want to own that particular NFT and instead of money, all they have is skills

let’s set a situation wherein the owner of the stolen NFT has not yet notified the community about the stolen good then the one who stole it can still very much sell it maybe for a lower price than the original owner would have wanted to sell it for the internet is still very dangerous and so are the people using it and no one truly knows the intentions and motives that one has for doing a specific thing just like satoshi randomly disappearing after launching bitcoin, no one still knows why he did that and we’re left wondering how did that benefit him in any way

We can’t really consider that situation because weren’t not talking of thousand of dollars. We’re talking of millions of dollars worth of NFT (as the OP says). How is it possible that it isn’t know, I mean… even if the owner doesn’t alert any NFT community, people will still likely know once they read the news. Well, be it as it may, I can’t be caught buying NFT (no matter how cheap), no, I don’t THINK so ;D. I still don’t feel the value as it was hyped so, I guess it has affected my perception of NFTs as a whole.