We've heard of NFTs being scammed, but can scammers leverage gasless signatures to steal your WETH as well? As it turns out, they can.
Let's take a look at how one might fall victim to an attack that takes your WETH away 1/🧵
Every one of you has some airdropped NFTs with juicy looking WETH offers on them, and most have probably wondered - are they safe to accept?
I still see a ton of misinformation circulating about these. Let's clear up WHY these are scams, and how it works. 1/🧵
1/ An investigation into how crypto influencer @thecryptolark promotes low cap projects to his audience just to dump on them shortly after.
Let’s dive in.
Today @kawpuccino lost over 10 eth in NFTs, to the tune of 1 @KaijuKingz, 1 @OthersideMeta, 1 @coolcatsnft pet, a @Pixelmon (lol), a Kaiju Mutant, and an IvyBoy.
This scam originated on OpenSea, but that is not where it happened. 1/🧵
🚨 NFT Drainer Alert!!! 🚨
What I posted about originally as being a scheme to get your Discord token has been used for more than that...
Attackers used the XSS attack with Everdome as a trusted site to also generate malicious OpenSea signature requests.
What you need to know:
Fighting scams is a constant arms race. Deploy better tools, attackers deploy better scams. There's a need to keep innovating; developing new ways to keep our assets safe in this wild west, where it seems nobody can be trusted.
Let's discuss HotWalletProxy, from @wenewlabs 1/🧵
🚨 CRITICAL ALERT: Chromium 0-Day
Google gave little to no details on this. They did mention its believed to be actively exploited. Recommend to UPDATE ASAP.