X2Y2 Hack

TOTAL LOST $200K
Low Phishing Attacks ethereum

What happened

Quick Summary

Scammers used exploit to fake X2Y2 marketplace and stole nearly 100 ETH.

Details of the Exploit

X2Y2 is a NFT marketplace for decentralized trading on the Etherium Blockchain. Scammers used Google Ads to advertise their fake link that lead to a phishing website. The website tried to get the users seed phrase and execute the function to empty account balances.

Roughly 100 ETH were stolen  by this method.

Block Data Reference

Address of scammer: https://etherscan.io/address/0x4A036aa8…D98EBC

0x81d3ec77438b4e99aa99ba25b1dbc3fea317fe3b0x81d3ec77438b4e99aa99ba25b1dbc3fea317fe3b

Case & protocol details

Classification NFT,Exchange (DEX) / Social Engineering
Protocol Type NFT Lending
Official Website x2y2.io
Protocol Twitter/X @the_x2y2

Security review history

Evidence & learning

Attack pattern

Compare incidents →
Phishing Attacks

Sources and on-chain records

Browse all hacks

Other incidents recorded with the same attack technique.

Whale Wallet Drain $25.6M
USDC Permit Signature Phishing $1.8M
Social Engineering Scam $282M
Address Poisoning Attack $50.0M

Practice this exploit pattern safely

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes