Incident Overview
The Twitter account of the artist DeeKay was hacked by a phishing attacker. A link with a phishing site was posted on the account. Users have lost a total of $150k due to interactions with the phishing link.
DeeKay is an artist who is engaged in drawing NFT collections.
The NFT artist DeeKay's Twitter account has been hacked. In a post on Twitter, a phishing link was posted, with a fake website, for a limited amount of new airdrops. 4 cool cats and 3 azuki were stolen from one of the holders of the collections. While DeeKay was restoring the Twitter account, the attacker address (A) managed to get about 65 NFT from several victims before the post was deleted. The hacker was able to sell the NFT for about $80k, then sent $ETH to the attacker address (B). 50 NFTs are still stored on their accounts.
Involved addresses:
Attacker address (A): https://etherscan.io/address/0x2100ab6a…f309ee
Attacker address (B): https://etherscan.io/address/0x5f232fed…58ab8e
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to DeeKay, these are the critical security checks that could have prevented this incident (July 2022).
- Verify all logic paths related to Phishing are guarded by proper access controls and input validation - see the Phishing Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
- 01
- 02
- 03
- 04
Learn to Prevent the Next DeeKay
The DeeKay hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.