What happened
On February 20, 2022, attackers impersonated OpenSea's contract-migration communication to induce users to sign malicious transactions. Check Point traced the signed requests through an attacker contract into the Wyvern Exchange, which executed transfers because the victims had approved the signed parameters. The investigators observed more than $2 million in ETH proceeds from sales of stolen NFTs.
How it happened
- Attackers sent phishing emails styled like OpenSea's real contract-migration communication.
- A malicious link sent the victim to a phishing site and prompted a transaction signature.
- That signature sent an atomicMatch request to the attacker's contract, which forwarded it to the Wyvern Exchange.
- Because the transaction had been signed by the victim, the exchange executed the approved NFT transfers to the attacker.
Protocol details
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
