What happened
In the early hours of July 21, 2022, attackers took over Tableland's Discord server, posed as moderators, and posted a link to a fake "exclusive, limited mint". The link went to claim.tableand.xyz, a lookalike domain missing the second "l" in tableland, which had been registered the day before. Clicking the site's mint button started a wallet-draining script that got some visitors to grant wallet permissions, which the attackers then used to take their NFTs. Tableland's write-up adds that fakemint attacks like this abuse the standard NFT setApprovalForAll approval. The site was reported to the registrar early on but stayed up for at least several more hours.
Stolen Tableland Rigs, plus NFTs from other collections such as Otherside Otherdeeds and Doodles Genesis Boxes, went to two Ethereum wallets. FakeMint 1 received eleven Rigs. It then sent 0.20 ETH to FakeMint 2 and forwarded some of the stolen NFTs to it, after which FakeMint 2 became the main wallet collecting from the drainer. FakeMint 2 received five more Rigs and 29 assets in total within twelve hours. Both wallets quickly sold the NFTs on LooksRare or through the GemSwap aggregator. FakeMint 1 had been funded with about 1.59 ETH from 0x71d…f8E2 starting July 17. Tableland published the analysis with Loggerhead Group and Colley Intelligence.
FakeMint 1: 0x288040312d39ce8fea20d85eb2d50cf31563b716
FakeMint 2: 0xb3b79426b163a53ea0f07ec28f72b77b3d30e8e9
How it happened
- From July 17, 2022, the future collecting wallet FakeMint 1 received about 1.59 ETH from
0x71d…f8E2. On July 20 the lookalike domaintableand.xyzwas registered with privacy protection, and a wallet-drain script was attached toclaim.tableand.xyz. - On July 21 the attackers took over Tableland's Discord, impersonated moderators, and advertised an exclusive, limited mint at the phishing link.
- Visitors clicked the site's mint button, which triggered the drainer in their browser wallet and got some of them to grant wallet permissions over their NFTs.
- The drainer moved Tableland Rigs and other NFTs to FakeMint 1. FakeMint 1 funded FakeMint 2 with 0.20 ETH, passed some NFTs to it, and FakeMint 2 became the new collecting wallet.
- Both wallets sold the stolen NFTs quickly on LooksRare or through GemSwap.
Protocol details
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
