How much was lost in the Miss Universe NFT hack?

The Miss Universe NFT hack resulted in $360K in losses on December 12, 2021.

What attack technique was used in the Miss Universe NFT exploit?

The Miss Universe NFT exploit utilized Rugpull. Understanding this attack vector is critical for smart contract auditors and developers building secure DeFi protocols.

How can developers prevent similar smart contract attacks?

Preventing smart contract hacks requires a combination of secure coding practices, thorough security audits, and understanding common attack vectors like reentrancy, oracle manipulation, and access control flaws. Smart Contract Hacking (SCH) provides hands-on training to help developers and auditors identify and prevent vulnerabilities before deployment.

Miss Universe NFT Hack

TOTAL LOST $360K

Low Dec 12, 2021 Rugpull

Affected Chain 2021 Incident surface

Recovered - No recovery reported

All-Time Rank #1097 By amount stolen

Protocol Type Exit Scam/Rugpull Target category

Incident Overview

Quick Summary

The official Miss Universe NFT project that boasted a roadmap with monthly AMAs, charity donations and signed prints, rugpulled its holders within 3 days after inception and incurred losses of approx. $360k to its holders.

Details of the Exploit

The Miss Universe NFT project was in fact endorsed by Paula Shugart, the president of The Miss Universe Organization as well as by Steve Harvey the famous American television host and other Miss Universe models. The project promised its holders an array of off-chain benefits such as exclusive events, signed prints and virtual AMAs with a strategic orientation towards women's empowerment.

Within the next day after the minting of the project took down its official Instagram account.

Moderators on discord still encouraged members to buy more NFTs. Within 3 days all social media channels were deleted.

The transactions that evolved on-chain appear to be undertaken by professionals since transfers and cash-outs between more than 20 wallets have been detected.

Block Data Reference

Miss Universe NFT token address: https://etherscan.io/token/0xa048c212…512c5c

Token creator addresses (Scammer):

1) https://etherscan.io/address/0x8831569a…f95a86

Some of the intermediary wallet address:

2) https://etherscan.io/address/0x0171a1e4…3d6a0e

3) https://etherscan.io/address/0x992ec9e3…d2925f

4) https://etherscan.io/address/0x83e657aa…e25c35

5) https://etherscan.io/address/0x3bd3de20…1011f6

Sample of cash out transactions:

1)https://etherscan.io/tx/0xe475a577…35ee52

2)https://etherscan.io/tx/0x34427861…da96c8

Incident Report

Protocol / Project Miss Universe NFT

Date of Incident December 12, 2021

Attack Technique Rugpull

Classification NFT

Primary Source View Post-Mortem #1 View Post-Mortem #2 View Post-Mortem #3

Protocol Information

Protocol Type Exit Scam/Rugpull

Affected Token MU

Official Website opensea.io/collection/miss-universe-nft-1

Team Public / Doxxed

Source Code Verified On-Chain

What the Attacker Needed to Succeed

Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.

Technical Knowledge Deep understanding of rugpull and Solidity and EVM internals

Capital Required Seed capital to cover gas and initial position setup

On-Chain Access Ability to interact with smart contracts and deploy a custom exploit contract

Protocol Analysis Identification of the exploitable vulnerability in Miss Universe NFT's contract logic - root cause: nft

Execution Speed Precise transaction ordering and timing to exploit the vulnerability within a single atomic block

Obfuscation Plan A strategy to launder and move stolen funds - typically through mixers, cross-chain bridges, or decentralized DEX swaps to resist tracing

What Auditors Should Check

Could this have been caught in audit? Hard to catch — private key / OpSec failures are outside smart contract audit scope

If you're auditing a protocol with similar architecture to Miss Universe NFT, these are the critical security checks that could have prevented this incident (December 2021).

Verify all logic paths related to Rugpull are guarded by proper access controls and input validation
Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs

Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.

Free Trial

Sources & References

01
Source 1 https://cointelegraph.com/news/beware-of-sophisticated-scams-and…
02
Source 2 https://twitter.com/zachxbt/status/1545426491340689408?s=21&t=HR…
03
Source 3 https://drive.google.com/file/d/174GN6tOyJF8jbhj2ADRUL_tU_Bh04td…
04
Web Archive https://web.archive.org/web/20220103162439/https://missuniversen…

Threat Assessment

Severity Level

LOW

Attack Vector Rugpull
Root Cause NFT
Year 2021

Learn to Prevent the Next Miss Universe NFT

The Miss Universe NFT hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.

Start Free Trial Browse Attack Library