The well-known NFT KOL and content creator NFT God said on the 14th:
My computer was hacked and all my cryptocurrencies and NFTs were stolen.
How did it happen? How to prevent it?
After NFT God downloaded the game: digital assets, NFT and all accounts were hacked
NFT God said that all of his digital life has been violated. Not only his digital assets, but also all his personal and work accounts have been hacked (Twitter, Substack, Gmail, Discord), and have also been used to harm others.
How did it all begin?
He said he downloaded OBS to his desktop computer. OBS is a video streaming software. NFT God wanted to use it for live streaming of games, but he accidentally clicked on a sponsorship link on Google.
When he pressed the executable file (exe.) and played the game for several hours, nothing happened. Until a friend told him "Your Twitter account has been hacked!". He said that he urgently deleted the scam post two minutes after the hacker posted it.
However, things are not that simple.
Soon after, someone else told him, "What's wrong with your boring ape?" That's when things really went wrong.
NFT God’s OpenSea page shows that his Boring Ape holder has switched to another wallet. All digital assets and NFTs have been transferred.
"I knew this was just the beginning. It wasn't just my wallet that was compromised. My entire digital life was compromised."
He rushed to the computer, deleted all passwords, deleted all data and reinstalled the Windows system.
Since NFT God has a newsletter, the hacker has emailed his 16,000 Substack subscribers. He said that what he lost was not only valuable digital assets, but what made him most heartbroken was the priceless brand and community trust.
Have any cold wallets been stolen? NFT God: Setting error
NFT God said he had a Ledger cold wallet, but made a key mistake. "I set it up like a hot wallet."
The way he entered the annotation messed up everything and made the cold wallet no longer a cold storage device.
"My wallet did not sign anything, nor did it participate in any malicious mint." NFT God explained.
Cos, founder of the security company SlowMist, commented that this is because the annotation on NFT God’s computer is connected to the Internet, which allows malware to take advantage of it. He suggested:
"Regularly check your private key/mnemonic phrase. If you have ever been exposed to the Internet (or other people you think are trustworthy besides you have it), you can extremely assume that the private key/mnemonic phrase has been leaked. In addition, you also need to check the authorization status of the wallet."
"Digital security is not just about buying a cold wallet. You must also be very careful with anything you do online," said NFT God.
He said that he will learn to let go, look forward, stay positive and not let the negative defeat him. "At least I still have health, family, and supportive friends."
SlowMist founder: MetaMask has disclosed similar vulnerabilities
MetaMask announced in June 2022 that selecting "Show Mnemonic Phrase" in the computer version to load the wallet will cause the mnemonic phrase to be temporarily stored on the computer hard drive, so that when the computer is compromised, it may Leaked mnemonic phrase. (But the mobile version of MetaMeak is not affected)
Cos (Cosine), the founder of SlowMist, said: “We have discovered this kind of security risk of exposing plaintext mnemonic phrases several times, especially when we successfully obtained the plaintext mnemonic phrase or the target user’s wallet without ignoring the wallet password. Private key."
MetaMask provides three prevention methods:
Enable full encryption on your computer's hard drive. This is the only way to ensure that your computer's contents cannot be physically accessed. (teaching)
Clear browser cache data
Remember that it is your responsibility to protect the security of your computer device. If the operating system is compromised, no wallet or software can guarantee security. You must learn how to avoid installing viruses on your computer.
Cos (Cosine), the founder of Slow Mist, once said:
"The two most critical security issues of Web3 are: key, which refers to the private key, and sign, which refers to the signature. If the security issues surrounding these two can be solved while improving the user experience, then this application will be a very successful entry-level application. Don’t just bring Web2 thinking to this application, because many Web2 thinking I see seriously lack security design.”
This article The well-known KOL "NFT God" was still stolen using a cold wallet. The founder of Slow Mist reminds: Regularly check the private key and annotation words first appeared on Lian News ABMedia.
