Krishna Okhandiar, co-founder of the decentralized autonomous organization (DAO) Remilia, which is known for launching the popular Milady non-fungible token (NFT) collection, claimed that his wallet was compromised following the transfer of millions worth in Ether (ETH) and NFTs to a new digital wallet.
First revealed by X (formerly Twitter) user @Dumpster_DAO, Okhandiar, who is also known by the pseudonym Charlotte Fang, reportedly said late Saturday that he "got drained." By Sunday, Okhandiar took to X to reveal that his "system got hacked and it compromised all imported wallets."
Remilia treasury appears to have been drained
— Dumpster DAO (@Dumpster_DAO) March 16, 2024
Assets from multiple official Remilia wallets have been moved to the address below and are being sold off
0x778Be423ef77A20A4493f846BdbcDDfc30252cE9 pic.twitter.com/AgwmVwWIE4
My system was hacked and it compromised all imported wallets. If you receive an odd message from any of my accounts, treat with caution. Still assessing, technical post-mortem will follow, but primary damage was the Fumo LP and the NFTs we held staked in NFTX, however NFT… https://t.co/K6w1CBTdFb
— ♡ Charlotte Fang 🐉 Crown Prince ❀ LOVE HEALS 💞 (@CharlotteFang77) March 16, 2024
He warned users to "treat with caution" any "odd message" they receive from his accounts. At the time of his first post, Okhandiar said a technical post-mortem report would be published, "but primary damage was the Fumo LP and the NFTs we held staked in NFTX." He also said NFT contract ownerships were "secure on hardware wallets." He added that it appears the hackers have dumped nearly all the NFTs taken into bids.
Remilia's new engineering team member, who goes by Tim Clancy, revealed in a report regarding the hack that Remilia's "hot wallets and its multisignature treasury were drained" in two waves of attacks. Okhandiar reposted the said technical report.
3/16 Hack - Technical Post-Mortem
— tim-clancy.eth (@_Enoch) March 17, 2024
Today Remilia’s hot wallets and its multisignature treasury (https://t.co/BvKw8jPdgT) were drained. The attack took place in two waves.
The first wave begins at 6:36pm UTC. The attacker 0x778Be423ef77A20A4493f846BdbcDDfc30252cE9… https://t.co/JAbwlq9QvC
The attacker obtained private keys to the wallet addresses of Okhandiar and Remilia to obtain millions worth of NFTs and Ether. "As of writing, the attacker seems to have concluded selling every NFT," Clancy wrote. He noted that Remilia isn't sure how the hack occurred. He noted that Remilia will "survive" the hack since its primary operating treasury "is held securely off-chain."
Amid questions about how the hack was pulled off, blockchain security firm Peckshield revealed that "it seems there is an earlier ownership transfer of Remilia treasury to the drainer."
It seems there is an earlier ownership transfer of Remilia treasury to the drainer: https://t.co/uwvBCWXJIy https://t.co/kQz7DEWDqA pic.twitter.com/XuYFMct3Dn
— PeckShield Inc. (@peckshield) March 16, 2024
Peckshield's revelation came as Cointelegraph reported that the transfer of ETH and NFTs was made "to a wallet engaged in asset liquidation."
News of the hack came more than a year after Fast Company wrote in an explosive report that from the beginning of the DAO's inception, "it felt like something was off about the people who were buying the Milady Maker NFTs."
The outlet noted that Milady NFT holders "tended to operate as a swarm on Twitter, dog piling other users, posting outrageous and offensive content." An X user also alleged in May 2022 that the founder of Remilia was linked to an "obscure 4chan-based suicide cult" and was "a prolific internet troll," as per the report. The allegations sent Milady prices crashing at the time.
Okhandiar was also accused of misappropriating "digital assets worth more than $600,000 from the venture's treasury" and of scheming "to seize control of Remilia's operations, assets and treasury of valuable digital assets" by Remilia co-founders.
Krishna has schemed to seize control of Remilia’s operations, assets and treasury of valuable digital assets. As co-founders, before we had even sent our letter to Krishna, he had misappropriated digital assets worth more than $600,000 from the venture’s treasury, and began…
— Sprite Bonkler 💫 (@Milady_Sonoro) September 25, 2023
