The world’s biggest marketplace for non-fungible tokens (NFTs) has warned its users to be on the alert for email phishing attacks following a massive data leak.
OpenSea, where traders exchange the crypto assets, told customers and newsletter subscribers not to open emails and files “sent by strangers” after revealing the breach.
It said its email database had been passed to an unnamed “unauthorised external party” by an employee at a firm used by OpenSea to send automated emails.
“We recently learned that an employee of Customer.io, our email delivery vendor, misused their employee access to download and share email addresses – provided by OpenSea users and subscribers to our newsletter – with an unauthorised external party,” said OpenSea.
It added that the potential impact was widespread. “If you have shared your email with OpenSea in the past, you should assume you were impacted.” OpenSea said the incident had been reported to law enforcement.
New York-based OpenSea said there may be a “heightened likelihood” for email phishing attempts targeting people whose data has been leaked. Phishing attacks involve tricking victims via email into downloading malware or handing over their login details. According OpenSea’s website, it has more than 600,000 users.
In a message sent to those affected, OpenSea urged users to be “extra cautious” about email safety. The firm warned users to avoid emails that impersonate its opensea.io domain and not to download anything from an opensea email, as well as avoiding opening any emails or files from strangers.
A customer.io spokesperson said: “We are working closely with OpenSea and are reviewing exactly how these email addresses were compromised. We believe this resulted from the actions of an employee who had role-specific access privileges that were abused.”
OpenSea has suffered other security incidents this year. In February an estimated $1.7m (£1.4m) worth of NFTs were stolen from the platform in an apparent phishing attacks, while in May OpenSea’s official Discord server was hacked.
NFTs confer ownership of a unique digital item – whether a piece of virtual art by Damien Hirst or a jacket to be worn in the metaverse – upon someone, even if that item can be easily copied. Ownership is recorded on a digital, decentralised ledger known as a blockchain. NFT spending reached $40bn last year from just $100m in 2020, although the rate of growth has slowed markedly amid a heavy crypto downturn.
News of the breach came as EU negotiators thrash out the final details on a sweeping package of crypto regulations for the bloc’s 27 nations, known as Markets in Crypto Assets, or MiCA.
The new regulations are expected to be influential outside the EU by setting a trend akin to the standards the bloc has set on data privacy. However, NFTs will not be included in the legislation.
The EU rules are “really the first comprehensive piece of crypto regulation in the world,” said Patrick Hansen, a crypto venture adviser at Presight Capital, a venture capital firm. “I think there will be a lot of jurisdictions that will look closely into how the EU has dealt with it since the EU is first here,” he added.
Under the Markets in Crypto Assets regulations, exchanges, brokers and other crypto companies face strict rules aimed at protecting consumers. The digital asset market has been hammered in recent weeks, with the cornerstone cryptocurrency, bitcoin, slipping back below $20,000 on Thursday – compared with a peak of nearly $69,000 in November last year.
Companies issuing or trading crypto assets such as stablecoins – which are usually tied to the dollar or a commodity like gold with the aim of making them less volatile than normal cryptocurrencies – face tough transparency requirements requiring them to provide detailed information on the risks, costs and charges that consumers face.
In a separate regulatory development on Wednesday, the EU agreed on new rules subjecting cryptocurrency transfers to the same money-laundering rules as traditional banking transfers.
When a crypto asset changes hands, information on both the source and the beneficiary would have to be stored on both sides of the transfer, according to the new rules. Crypto companies would have to hand this information over to authorities investigating criminal activity such as money laundering or terrorist financing.
