Discord hackers steal millions of dollars in NFTs

Discord is not only a popular place to exchange ideas, hackers are also increasingly drawn to certain servers with one goal: steal valuable NFTs. The damage is now in the millions. New analyzes point to a connection between the phishing attacks.

NFTs stolen for $22 million

The social media platform Discord has seen an increase in hacker attacks over the past three months. This is the result of an evaluation by the blockchain security company TRM Labs. The common method: so-called phishing, in which users are linked to fraudulent websites and personal data is tapped. Hackers seem to be targeting valuable NFTs more and more frequently.

According to TRM Labs, phishing attacks related to NFT thefts increased by 55 percent in June. Over 100 reports of hacks on Discord channels have been reported to the company in the last two months. The NFTs lost around $22 million since May, according to the report.

Target: Bored Ape Yacht Club

The attackers act in a targeted manner, with high-priced NFTs such as those of the Bored Ape Yacht Club (BAYC) being stolen in particular. On June 4th, the Discord server of Yuga Labs, the company behind the NFT Collection, became the target of multiple phishing attacks. Users were promised exclusive giveaways. After following the links and connecting their wallet, the attackers transferred the NFTs to their own wallet.

A total of 32 NFTs, including Bored Apes and Otherside NFTs, worth 140 Ether were tapped. A month earlier, a similar attack took place via the Bored Ape Yacht Club Instagram account.

Same patterns

Not an isolated example, the attacks have method according to TRM Labs. As evaluations of on- and off-chain data show, “many of the Discord attacks on NFT projects show similar behavioral patterns”. Including phishing attacks on accounts of the NFT projects Bubbleworld, Parallel, Lacoste, Tasties, Anata and “a dozen others”. The June 4 incident on the Yuga Labs Discord server is also said to be part of the orchestrated series of attacks.

“We are seeing an increase in attacks on NFT projects and other crypto businesses over the past few months,” said Ari Redbord, head of legal at TRM Labs. Such incidents could continue to increase “as long as cybercriminals are able to steal large amounts of funds or assets that can be sold for money.”

Search for clues on the blockchain

The scheme is always the same: Attackers create fraudulent accounts, pretend to be administrators, advertise campaigns such as giveaways, i.e. supposedly free distributions from NFTs, for example, and send out phishing links. In doing so, they urge “users to act quickly so as not to miss out on a free giveaway or limited stock.”

The stolen NFTs were initially sold for ether through marketplaces, according to TRM Labs. Most of the proceeds were sent to three different wallets before the funds were moved to other wallets via ETH mixer Tornado Cash and exchanged for BTC via “decentralized services, gambling websites and a dark web market”. One of the three wallets “was also connected to wallets directly related to other Discord breaches that took place in May and June 2022,” according to TRM Labs.

It is not yet clear who or how many people are behind the attacks. However, the professional approach suggests several actors who could be part of a hacker group.

How to protect yourself

Discord takes “the security of all users and communities very seriously,” a Discord spokesman told. Although there are “clear controls,” we continue to develop methods to “complicate social engineering attacks” and improve “tools to protect our users.” The company invests “continuously in security improvements”, suspicious users are blocked, servers are shut down. Spam can be reported directly to Discod, and a system is also being tested “that monitors the server for inauthentic behavior of new members and proactively puts the server in a safe mode”.

Ultimately, however, users must be vigilant. “Individuals should be aware of common attack vectors, including platforms like Discord, and common tactics used by threat actors, including phishing attacks that use FOMO-inducing language,” said TRM investigator Monika Laird. “Users can also check the messages on a project’s other social media accounts on platforms like Telegram, Twitter or Instagram to see if there are any giveaways being promoted or discussed.”

Phishing attacks cannot be reversed. The best precaution: be careful – do not pass on any data, do not be fooled by alleged profit campaigns, do not click on any suspicious links. Fraudulent actions are often obvious at first glance. For example, if they are allegedly advertised by prominent people such as Vitalik Buterin or Charles Hoskinson. Or are only available for a short time. With a few exceptions, nothing is given away on the Internet, and certainly not on Discord servers.