The month of April brought with it some bad news for the NFT community. In the early hours of April Fool’s Day, the Discord servers for Bored Ape Yacht Club (BAYC), Nyoki Club, and other popular NFT projects were hacked. The attackers took control of the Discord channel bots and used them to trick users into clicking links that promised the minting of non-existent non-fungible tokens.
After realizing that their Discord servers were compromised, BAYC, Shamanz, and Nyoki Club posted on Twitter about the attack. The same day, independent blockchain detective Zachxbt tweeted that the Discord channels of two more NFT projects, Doodle and Kaju Kings, were also used to scam users. Later, a smart contracts platform Etherscan revealed that the hackers used wallets named Fake_Phishing5519 and Fake_Phishing5520 for transactions during the attack.
How did the hackers use the discord bots to fool NFT buyers?
After taking control of a channel’s Discord bot, the hackers started posting fake NFT minting offers using the bot. For example, on the BAYC Discord: “Oh no, our dogs are mutating, MAKC can be staked for our $APE token. Holders of MAYC + BAYC will be able to claim exclusive rewards just by simply minting and holding our mutant dogs.”
The Discord posts included a link to a phishing site and mentioned that users would get exclusive rewards after minting a specific NFT from the site. NFT buyers are usually excited about any exclusive drops and offers from popular projects such as BAYC. So many clicked on the phishing links and paid ETH hoping that they would be able to mint an NFT that, in reality, never existed.
One buyer paid 19.85 ETH, roughly $69,000, for a stolen NFT that never made it to his wallet. The phishing wallet that received this amount sent 61 ETH in total ($211,000) to another unnamed wallet through a website Tornado Cash that facilitates transactions after disconnecting the blockchain link between the source and the recipient. Therefore, making the transaction challenging to trace.
Surprisingly, the unnamed master wallet currently holds cryptocurrencies worth $5.9 million.
Not the first time Discord has been compromised
Discord is a go-to place for NFT enthusiasts to learn about what’s happening in the NFT market. From the latest community news to updates on the biggest NFT drops, Discord is the hub of all things NFT, and maybe this is why the platform is also grabbing the attention of scammers and hackers.
This year’s April Fools’ phishing attract isn’t the first time hackers have used Discord to rob NFT holders. Last year in December, users of Solana-powered NFT projects Fractal and Monkey Kingdom also faced phishing fraud via the official servers. According to a report, hackers were able to steal crypto worth $150,000 and $1.3 million from Fractal and Monkey Kingdom NFT holders, respectively.
Since Discord is such an important platform for the NFT community, it’s vital that the company takes the necessary steps to prevent future attacks. In an interview with The Verge, Peter Day, Group Manager of Corporate communications at Discord, said, “we are always working to make it harder for these attacks to happen and will continue to invest in education and tools to help protect our users.”
NFTs now represent a booming billion-dollar industry. From underground artists to established brands, everyone is coming to the NFT market because people have trust in the NFT world. At such times, the unfortunate incidents involving phishing scams affect NFT users and hurt the sentiments of people who look forward to becoming a part of the growing NFT market. These attacks indicate that the blockchain community needs to take some solid steps for ensuring the interest of NFT lovers across the globe.
