What happened
On January 27, 2023, attackers took over Azuki's official Twitter account and used it to post links for a fake Azuki land mint. The links led users to a wallet-draining contract that induced them to sign transactions transferring assets from their wallets. Decrypt reported that, in under 30 minutes, victims lost more than $750,000 in USDC, 11 NFTs, and more than 3.9 ETH; the malicious posts were later removed and wallet providers blocked the phishing domains.
How it happened
- Attackers gained control of Azuki's official Twitter account.
- They posted a purported surprise land-mint link under the trusted project identity.
- Users who connected and signed the prompted transaction interacted with a wallet-draining contract rather than a genuine mint.
- The contract transferred USDC, NFTs, and ETH from victim wallets to attacker-controlled addresses.
Protocol details
Evidence
- report @_joinfire incident report twitter.com
- analysis Azuki Twitter Account Hacked, Attacker Drains Over $750K in 30 Minutes decrypt.co
- analysis Azuki NFT Twitter Account Hacked, $750,000 Stolen in Scam cryptometer.io
- analysis Web Archive archive.ph
- analysis About Azuki azuki.com
- analysis Azuki official Telegram channel linking its X account t.me
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
