- The Metadata
- Posts
- Kevin gets phished for $2M+ in NFTs
Kevin gets phished for $2M+ in NFTs
In our humble opinion, hacks like this are a design failure on Ethereum and wallets like Metamask.
The Metadata
January 26, 2023
GM. We're so excited to have you join us for another edition of our NFT newsletter. Today's a good one, we've got lots of exciting content and projects to share. Let's get right into it.
Today we cover:
APE spending on the Dookey Dash game
Kevin Rose gets phished for $2M+ in NFTs. Don't be like him.
New & interesting NFT projects
Today's Coolest Tweets
$700,000+ in APE spent on Dookey Dash Game
The above chart shows the dollar value of APE tokens that users have been burned in Yuga Lab's Dookey Dash game over the past 7 days. That's $700,000+ in tokens spent.
It's still tiny compared to games like Candy Crush which see $3M+ in daily in-app purchases. Yet, if you consider it on a per-user basis, it's huge.
(h/t @_ConorMoore for the chart)
Kevin Rose Gets Phished For $2M
💲 What to know: Kevin Rose, the founder of PROOF Collective & Moonbirds, was phished and lost $2M+ in NFTs.
All because he signed a scam transaction on his wallet.
☘️ In the weeds: Here's what he lost (it's heartbreaking 💔 ):
1 Autoglyph ($550,000)
25 beautiful Chromic Squiggles (>$600,000)
On-chain monkeys, Cool Cats, QQL Mint Pass and more
Thankfully, his most valuable assets were saved through quick action, including his CryptoPunks ($1M - $2M value) and XCOPY 1-of-1 artworks (~$800,000).
According to Kevin's team, it was a piece of social engineering that tricked him into signing something that looked like a legitimate OpenSea transaction. It probably involved creating a valid order consisting of listing all of his NFT assets for 0 ETH.
0xQuit covered the details pretty succinctly:
6/ A site can easily read the contents of your wallet, and create a valid order consisting of All of your assets (that are approved to OpenSea) on the offer side, and nothing at all on the consideration side.
Then, all that's left is for you to sign it to make it valid.
— quit (@0xQuit)
7:48 PM • Jan 25, 2023
🤑 Why it matters: Kevin Rose has been in the Web3 space for a long time as a founder, investor, and collector. He's sophisticated and knowledgeable, definitely not a newbie in the space. If he can get hacked, anyone can — including you and us. So it's important never to let your guard down. DCinvestor has some good tips we think everyone should follow:
wallet best practices:
- keep valuable NFTs in a separate "vault" address
- only single transfer in/out from it. NEVER list for sale or "batch transfer"
- use delegate.cash to one-time delegate "sign" authority to a lukewarm/hot wallet
- don't sign anything else— DCinvestor.eth ⌐◨-◨ (@iamDCinvestor)
8:52 PM • Jan 25, 2023
In our humble opinion, hacks like this are a design failure on Ethereum and wallets like Metamask. It's inexcusable for a user not to be able to see what happens in advance before he signs a transaction. There are tools that can simulate what happens in a transaction (e.g. which assets get transferred) and these should be more readily available to users.
This will continue to be a barrier keeping new people unfamiliar with crypto from entering the space.
New & Interesting NFT Projects
🍿 (Game) Register for WL spot for DigiDaigaku Dragons
🚨🚨🐉
We’re releasing 10,000 @DigiDaigaku Dragons live during the Digi Superbowl commercial! Register now for your chance at a guaranteed spot on the WL before the BIGGEST FREE MINT EVER!
RULES:
✅ GO TO
✅ COMPLETE REGISTRATION
✅ RETWEET THIS TWEET— Gabriel Leydon (FREE,OWN) (@gabrielleydon)
6:26 PM • Jan 25, 2023
🍿 (Art) Something Fishy is launching on Feb 4
Something Is Coming To Web3 This Month👀🪸
-fully animated, 3D fish tanks
-unique, detailed environments
-4k resolution
-display in your homeEngage to be considered…🎣
— Something’s Fishy (@SOMETHlNGFlSHY)
4:27 PM • Jan 5, 2023
🍿 (Game) Sega is launching something? 18 day countdown timer
csmashvrs.com
// Looks like @SEGA are up to something, not much info yet, but the website has a countdown timer.
// Notis on, for their twitter.
credit: @spacemanbtw 🔌
— A-1 (@iiaone)
8:13 PM • Jan 25, 2023
Today's Coolest Tweets
🐥 Thoughts on brands getting into Web3
Brands On-chain!
Leaping into blockchain tech is no small thing as a brand. To take on new technology that impacts the way you connect, communicate, transact & create your products.
So it’s no surprise that many brands stumble and fall. Here are some thoughts on this topic ⬇️ http
— Mel 🦇🔊 (@belikewater893)
6:13 AM • Jan 25, 2023
🐥 New talented glitch artists to follow
🧵New talented glitch artists are flourishing such @KungfuHavestyle@kingxerox5 or even @bongdoe. One that really caught my attention over the last weeks is @alperaym with Blu Family - I am showing my 4 favourites. Let me know which one you prefer 👇
— L'anamour (@Cat555552)
11:49 PM • Jan 25, 2023
🐥 MagicSwap will be the AMM to beat
Announcing the new MagicSwap by @Treasure_DAO.
MagicSwap v2 will be the first AMM in crypto with universal token compatibility, supporting pools for both ERC-20s + NFTs through a single router and enabling trading of all items within game economies.
👇
— MagicSwap (@MagicSwap_)
8:53 PM • Jan 25, 2023
🐥 Pranksy is bullish on the Doodles
I don't tend to write long threads, but @doodles launching #Doodles2 on @flow_blockchain has caused such an uproar. I wanted to provide my personal point of view, as someone who in 2019 said in interview that @NBATopShot was the chance for #NFTs to reach the mainstream...
— Pranksy 📦 (@pranksy)
8:46 PM • Jan 25, 2023
🐥 Exploiting the Dookey Dash game
I spent the last 5 days trying to exploit Dookey Dash from @BoredApeYC.
It took many attempts, but I finally did it.
Here's video proof of me going through every obstacle type and still registering a valid run on their system (more info in the thread):
— cygaar (@0xCygaar)
5:24 PM • Jan 25, 2023
🐥 Play Dookey Dash even if you don't have a sewer pass: worth a try
📢 Attention gamers and @BoredApeYC holders!!
We just released a cool app on Dookey Dash, powered by Narval wallet tech. Gamers who don’t have a Sewer Pass can play the game in turn for 10 minutes
(1/3)
— Narval (@Narvalgmi)
2:23 PM • Jan 25, 2023
🐥 Adidas launches 3 stripes studio, it's web3 division
I'm so excited to introduce you to the newly formed /// Studio (aka Three Stripes Studio)!
The /// Studio represents a group of creative degens and boundary-breaking three stripes stans who are determined to push at the frontiers of innovation, collaboration and culture 👇(1/4)
— Indigo Herz (@indigo_herz)
6:04 PM • Jan 25, 2023
That's it for today folks, see you tomorrow. If you want more, follow us on Twitter (@the_metadata). And if you aren't already a subscriber, join us now to get all the daily alpha you need.
We're looking to improve the newsletter and make it as relevant as possible for you. If you have any feedback to share — please just reply to this email and let us know. Or even to just say 'Hi'.
Disclaimer: This newsletter is for educational purposes only. None of this is financial or investment advice. It is not a solicitation to buy or sell any assets. Minting and buying NFTs is risky. Please do your own research.