What happened
On 18 November 2021 at about 16:00 UTC (3 a.m. on 19 November, Sydney time) attackers took over the official Discord server of Phantom Galaxies, a game from Animoca Brands' studio Blowfish, and used it to run a fake NFT mint. Animoca said a malware bot compromised the two-factor authentication on the server's admin account. The attackers then posted announcements of an immediate mint that sent users to a fake site charging 0.1 ETH per mint. Nothing was minted. The ETH went to the attackers' wallet 0x5b54e19f06f8FB4B28eE2c6958E55F4580F64ae1.
About 265 ETH (about $1.1 million) was taken in roughly 1,571 transactions over three hours. Animoca said it found no evidence that any smart contract was compromised, and that no funds were taken from the game, its developer or its publisher. On 24 November Animoca Brands and Blowfish committed to covering the full 265 ETH lost by users, with the compensation method to be set after community discussion.
How it happened
- A malware bot compromised the two-factor authentication on the Phantom Galaxies Discord admin account, giving the attackers control of the server.
- The attackers posted fake official announcements of an immediate NFT mint.
- The announcements linked to a fake minting site that charged 0.1 ETH per transaction.
- Each payment went straight to the attackers' Ethereum wallet and no NFT was minted. About 1,571 payments totalling roughly 265 ETH arrived over three hours.
Protocol details
Evidence
- transaction Etherscan transaction list for address 0x5b54e19f06f8FB4B28eE2c6958E55F4580F64ae1 etherscan.io
- analysis DeFiLlama defillama.com
- analysis Animoca Brands update on hacking of Discord server of Phantom Galaxies; will cover users' losses animocabrands.com
- analysis Animoca Brands to Cover Losses From 'Phantom Galaxies' Discord Hack coindesk.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
