Leaked OpenSea user emails now public, SlowMist warns of phishing risks

by

Approximately 7 million users on OpenSea may face potential risks following the recent exposure of emails that were involved in a data breach in 2022, which have now become publicly accessible.

As reported by the Chief Information Security Officer at blockchain security firm SlowMist (23pds), leaked data can substantially heighten the chances of phishing and other cyber-attacks. In a post on Reddit’s cryptocurrency forum on January 13, this security researcher warned members of the crypto community that the data in question had been spread out numerous times prior to its publication.

23pds noted that the exposed data encompasses email addresses of notable figures within the cryptocurrency sector, including Changpeng “CZ” Zhao, previous Binance CEO, along with well-known companies, key influencers, and other powerful individuals. They cautioned that this could potentially increase the dangers to privacy and asset protection in the crypto industry down the line.

In a June 2022 occurrence, the email addresses at issue were breached due to an employee of Customer.io, who serves as OpenSea’s email distributor, improperly using their access to download and disseminate email addresses given by OpenSea users and newsletter subscribers to a party outside the system without authorization.

Currently, the non-fungible token marketplace is urging users to stay vigilant against potential phishing and impersonation scams. They recommend refraining from downloading attachments or executing wallet transactions via email links, as all legitimate communication will originate solely from their ‘opensea.io’ website domain.

On multiple instances, users of the popular NFT marketplace, OpenSea, have fallen victim to phishing scams. In the recent past, just after a data breach in December 2022, a security platform warned users about cybercriminals creating fraudulent websites to exploit OpenSea’s gasless transaction feature. These victims were deceived into approving confusing signature requests, unaware that they were authorizing private sales or swift transfers of valuable NFTs to the accounts of the scammers.

In November 2023, OpenSea developers encountered phishing attacks, such as fraudulent developer account warning messages. This has led certain experts to speculate that the developers’ contact details might have been compromised.

In January of 2024, fraudsters sent emails to OpenSea users, claiming they had been chosen for an exclusive NFT minting event in collaboration with Nike and RTFKT. The email stated that the recipients were among only 400 participants and contained a link labelled “Mint RTFKT Now.” However, this link supposedly led to a malicious website intended to steal users’ wallet information or funds.

As a researcher studying the realm of cryptocurrencies, I can’t stress enough the persistent danger that phishing scams pose for enthusiasts like us. These deceptive schemes can take various shapes, making them elusive and challenging to track down. Worse still, they’re often tricky to foil effectively. To safeguard ourselves, experts urge us to maintain a heightened sense of vigilance. This includes scrutinizing the origins of emails, refraining from clicking on unfamiliar links, activating two-factor authentication, and strictly abstaining from disclosing private wallet keys or sensitive information online.

Read More

2025-01-13 12:18