Curriculum·Graduate·G705
Scam Response for Community Leaders
Ronin Network, 23 to 29 March 2022.5 million USDC, about $624 million, in two transactions.
Start with lesson 14 lessons · about 2.1 hours · free account to read in full
Lesson 1 opens on
The OpenSea phishing, 19 February 2022
As OpenSea migrated its marketplace to a new contract, users received a phishing email dressed as an OpenSea notice asking them to migrate their listings to the new contract within a window. The email's link led to a page that asked users to sign a message. Per later analyses, including Check Point's, the signature authorized an order under the marketplace's Wyvern contract that the attacker could complete and execute, transferring the signed NFTs to themselves.
The lessons
- G705-01The first hour, at community scaleState what happened to OpenSea users on 19 February 2022, how many were affected, what they had signed, and what it costabout 32 min · opens on The OpenSea phishing, 19 February 2022
- G705-02Containment and the response clockState the timeline of the Ledger Connect Kit compromise of 14 December 2023: how access was obtained, when the malicious versions were published, when the fix shipped, and how long the exposure lastedabout 32 min · opens on The Ledger Connect Kit supply chain attack, 14 December 2023
- G705-03Detection, disclosure and the cost of silenceState what was taken from the Ronin bridge in March 2022, how, and how and when it was discoveredabout 31 min · opens on The Ronin Network bridge, 23 to 29 March 2022
- G705-04After: the second wave and the postmortemState what happened in the Kroll breach of August 2023, whose data was exposed, how, and what followed within daysabout 31 min · opens on The Kroll SIM-swap breach, 19 August 2023