What happened
In May 2022, scammers stole about 100 ETH (roughly $200,000) from users of the NFT marketplace X2Y2 by buying Google search ads that led to a fake copy of the site. The incident was a phishing campaign against X2Y2's users. No source reports a flaw in X2Y2's own contracts.
The ads used a Google Ads trick that made the displayed URL look exactly like X2Y2's real address, and they appeared above the genuine result when people searched for the marketplace. The fake site immediately asked visitors to connect their MetaMask wallet, and funds were then drained. The sources reviewed do not say exactly what victims were asked to sign or enter.
On May 10, 2022, a Twitter user known as Serpent publicized the scam and reported about 100 ETH already stolen. He found several phishing contracts that all fed a single wallet, linked it to an NFT project called Px Skull, and confronted its operator ("Predator"), who then deleted the project's Telegram group and blocked him. The phishing sites were later taken down.
**Block data**
- Address listed for this scam, labelled Fake_Phishing5730 on Etherscan: 0x4A036aa86D0BA304EC60605155810A6973D98EBC
How it happened
- The scammers bought Google search ads for X2Y2 whose displayed URL matched the real marketplace, so the ad sat above the genuine result.
- Users who clicked landed on a cloned X2Y2 site that immediately prompted them to connect MetaMask.
- Victims' funds were then drained through phishing contracts that all forwarded to one wallet, totalling about 100 ETH.
Protocol details
Security review history
- SECBIT Labs View report
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
