Tweet thread by 0xQuit
Primary Source ↗Incident Details
A trader who owned a Bored Ape and two Mutant Ape NFTs apparently reached a deal to trade them for three different Bored Ape NFTs. Because OpenSea doesn’t support swapping NFTs directly, only buying and selling them for ETH, the traders used a less-known platform called KiwiSwap to do the trade. Like many platforms, KiwiSwap aims to help users spot faked NFTs by showing a “verified” badge — however, because the platform shows the badge overlaid on the NFT image, a scammer was able to create imitation Bored Apes that included the same checkmark as a part of the image, making them appear legitimate. KiwiSwap also does not include functionality that would allow a user to click through to verify the NFT is the one it claims to be.When the user confirmed the transaction, they transferred their three pricey apes to the scammer, receiving three worthless ones in return. NFT trader 0xQuit estimated the loss at around $587,000.
Total loss estimated at $587,000.
Technical Details
- Initial Attack Vector
- Smart contract exploit / hack
- Vendor / Product
- s27 NFT theft
Timeline
- 2022-04-04 Breach occurred
- 2022-04-04 Publicly disclosed