North Korean hackers created over 500 phishing domains to steal NFTs

Article Reading Time:
1 min.

SlowMist, a company specializing in blockchain security, has published a report in which it presented data on phishing attacks on cryptocurrency wallets over the past few months.

According to the report, the North Korean hacker group Lazarus targeted the wallets of investors in non-fungible tokens (NFTs) – the attackers used more than 500 phishing addresses to steal digital assets.In addition, experts found sites masquerading as popular NFT platforms such as OpenSea, Rarible, and X2Y2, as well as sites related to the World Cup. 

One of the favorite tactics of hackers has been the creation of websites that allegedly allow the user to issue their own token.When a user connects their wallet to the site, the data is immediately transferredExperts noted that 372 phishing sites operated under the same IP, and another 320 were associated with a different IP. 

SlowMist reported that such attacks have been going on for more than six months – the earliest registered domain name appeared seven months ago.One of the websites managed to steal more than 1,000 NFTs and 300 ETH worth over $367,000.In addition, hackers used fake websites to collect data about users, which they then used to attack crypto wallets on their own. 

The experts noted that their report representssuperficial look at the problem and in reality hackers have many other tactics. Earlier, South Korean intelligence published data for 2022, according to which North Korean hacker groups stole more than $620 million worth of cryptocurrencies, and since 2017, assets worth $1.2 billion have been stolen.