OpenSea has warned its users that they may be at risk to a scammer that has hacked the company from the inside.
VIEW GALLERY – 2 IMAGES
The world’s largest NFT marketplace has taken to its blog to announce that an employee at Customer.io, which is the company’s email vendor, used their employee access to download and share email addresses from OpenSea users, along with any subscribers to the OpenSea newsletter. OpenSea has stated that an investigation has been launched into the matter and that law enforcement has already been contacted regarding the hack.
Since the hack was predominately email address-targeted, users should be very careful about being contacted via email by anyone who is stating they are an OpenSea employee. The NFT platform explains that the email address malicious actors will use will look very similar to the official email domain – ‘official email address domain = “opensea.io“. The platform stresses in its safety and recommendations that it will only ever contact users from the domain “opensea.io” and that any other variation of the email is illegitimate.
Furthermore, OpenSea recommends that users never download anything from an OpenSea email, as authentic OpenSea emails will never contain anything that is downloadable or any attachment files. While it may be obvious to some, never share any secret wallet phrases or passwords with anyone, even if they are saying they are an OpenSea employee.
“The disclosure of the email list certainly gives the attacker a solid base of active individuals from which to attempt to steal their NFTs and, likely, distribute malware. Individuals and companies who receive emails from OpenSea about new and ongoing activities should instead conduct these manually through the opensea.io website,” warns Karl Steinkamp, the director at Coalfire.
Notably, users should never sign a wallet transaction via email. OpenSea states that its official emails will never contain links that prompt users to sign a wallet transaction….
