The NFT channels of Memeland, Axie Infinity, Lazy Lions NFT, PROOF/Moonbirds, and RTFKT were among those affected. One discord security expert estimates that the affected servers have a total of 2,765,000 users.
Attackers Used MEE6 to Compromise NFT Channels
MEE6 is a moderation and chat bot used by over 18 million Discord servers. It can perform a variety of functions, including moderating channels, searching for content, and creating voice recordings. Users can also create custom commands for MEE6. The hackers used MEE6 to send out malicious phishing links on the targeted channels, announcing a fake NFT project. Thankfully, the moderators of most of the targeted channels managed to identify the phishing attack, warn users, and delete the insidious messages. Members of NFT channels on Discord have been cautioned to be vigilant for phishing attacks. Web3 platform CyberConnect told users it would never ask for their private keys over Discord.
Statement by Discord
Discord has revealed that a compromised employee’s account was the source of the hack. The company insists that there was no technical breach of its systems. In a statement via the MEE6 official Twitter page, Discord noted that the issue has been resolved, and it will take steps to prevent the recurrence of a similar incident. “We take security very seriously, and will always be committed not only to keep our systems safe but also add extra measures to protect servers from accounts being compromised,” the statement reads. However, some users are not satisfied with Discord’s response and have called for a greater degree of accountability as well as a plan to reimburse the affected users.
Hackers Continue to Target NFT Projects Through Social Channels
Cryptocurrencies and NFT projects have had a torrid start to 2022 with several high-profile cyberattacks. In March, hackers stole about $620 million from the Ronin Network in one of the largest cryptocurrency cyberattacks to date. Hackers appear to be targeting the Discord channels and social media platforms of popular NFT projects to carry out phishing attacks. Last month, cybercriminals made away with NFTs worth $13.7 million after taking over the Bored Ape Yacht Club’s Instagram account and sharing a link to fake NFTs. Earlier this month, hackers stole a relatively smaller bounty of $26,903 after gaining access to the Discord servers of NFT marketplace OpenSea and promoting a fake project (update editorial team: original page not available anymore on the website of the source). If you found this story interesting, we recommend checking out our guide to avoiding NFT scams.
