{"id":9872,"date":"2022-04-06T11:43:56","date_gmt":"2022-04-06T11:43:56","guid":{"rendered":"https:\/\/nftandcrypto-news.com\/nft\/nft-traders-beware-of-social-engineering-hacks\/"},"modified":"2022-04-06T11:43:57","modified_gmt":"2022-04-06T11:43:57","slug":"nft-traders-beware-of-social-engineering-hacks","status":"publish","type":"post","link":"https:\/\/nftandcrypto-news.com\/nft\/nft-traders-beware-of-social-engineering-hacks\/","title":{"rendered":"NFT Traders, Beware of Social Engineering Hacks"},"content":{"rendered":"
\n
Source: 0xQuit \/ Twitter<\/figcaption><\/figure>\n

\u00a0<\/p>\n

Holders of blue-chip non-fungible tokens (NFTs) have long been targets of various types of attacks given the value of their possessions – and now scammers seem to have found new loopholes to take advantage of.<\/p>\n

A popular vector of attack for scammers has so far been malicious links, where scammers hack into a project’s social platforms and publish phishing links – as previously happened to Solana-based NFT collection Monkey Kingdom.<\/i><\/p>\n

However, more recently, there seems to be a trend where scammers try to exploit loopholes in the UX (user experience) \/ UI (user interface) design of NFT platforms to steal valuable collectibles from potential users.<\/p>\n

Just earlier this year, scammers were able to exploit an issue related to the UI design of major NFT marketplace OpenSea <\/strong>to buy NFTs for old listing prices, which were far below the collection’s floor price.<\/p>\n

In a similar manner, a Bored Ape Yacht Club<\/i> (BAYC) NFT holder recently lost three of their valuable NFTs largely due to the poor UI\/UX design of an NFT platform.<\/p>\n

The pseudonymous 0xQuit took to Twitter to reveal the details of how user “s27,” who entered into a direct swap trade using Swapkiwi<\/strong>, a peer-to-peer NFT swapping platform, fell victim to a scam.<\/p>\n

Apparently, s27 had agreed to swap BAYC<\/i> #1584<\/i> and two Mutant Ape<\/i> derivatives (#13168<\/i> and #13169<\/i>), cumulatively worth over USD 560,000 given the current floor price, with another user’s BAYC<\/i> #4424, #5406<\/i>, and #2007<\/i> – only these BAYC NFTs were simply knock-offs.<\/p>\n

<\/oembed><\/figure>\n

Swapkiwi does display verified NFTs with a checkmark, but the checkmark appears within the image. Taking advantage of this, the scammer photoshopped fake JPEGs to place a checkmark on them, making them look like verified BAYC<\/strong> NFTs.<\/p>\n

“The scammer added these checkmarks to the knock-off NFTs exclusively to make them appear legitimate on swapkiwi,” 0xQuit said, adding:<\/p>\n

\n

“Furthermore, there’s no immediately apparent way to click through to view the asset or the asset contract, making it unnecessarily burdensome to verify the assets.”<\/p>\n<\/blockquote>\n

The incident has some lessons for NFT traders. In the first place, if “it sounds too good to be true, it probably is,” 0xQuit said, noting that it is very unlikely for a user to swap three BAYC <\/i>NFTs for a BAYC <\/i>and two mutant apes, which are significantly cheaper than the original collection.<\/p>\n

Moreover, NFT traders need to verify everything independently. In other words, assume “everybody is out to get you.”\u00a0<\/p>\n

While Swapkiwi does not have an option to instantly allow traders to view the asset contract, traders can use blockchain explorers like Etherscan to verify assets and make sure they are original.\u00a0<\/p>\n

\n

“This goes for other assets too,” 0xQuit said.” I’ve seen similar scams with tokens, where a scammer will submit a picture with the words “20 WETH” on it in place of 20 WETH.”\u00a0<\/p>\n<\/blockquote>\n

Meanwhile, Swapkiwi has said they are working on improvements and pledged to “make the necessary changes so this doesn\u2019t happen again on swapkiwi.”\u00a0<\/p>\n

<\/oembed><\/figure>\n

____<\/p>\n

<\/strong>
– No, Sberbank Isn\u2019t Selling a \u2018Cryptocurrency\u2019 on a DeFi Exchange \u2013 Here\u2019s What\u2019s Really Going On
– Scammers Impersonate CoinMarketCap to Sell Fake ‘CMC’ Tokens<\/p>\n

– Impostors Make Deep Fake Videos of Ordinary ‘More Believable’ People to Promote Crypto Scams
– Scam Tokens Emerge After \u2018Elona\u2019 Musk’s Dispute With Chechen Leader
– Impostors Are Trying to Trick Ukrainian Crypto Donors via Phishing Websites and Fake Donation Addresses<\/p>\n

– Here’s How You Can Protect Yourself Against Phishing as Trezor is Attacked
– Web 3 Hackers Are Getting Smarter: Here\u2019s How to Stay Safe<\/p>\n<\/p><\/div>\n