Curriculum·G705 Scam Response for Community Leaders·about 32 min
The first hour, at community scale
By the end of this lesson you can
- →State what happened to OpenSea users on 19 February 2022, how many were affected, what they had signed, and what it cost
- →Explain why the first hour of a community incident is spent on containment and one message, and why the postmortem waits
- →Compute the cost of an hour's delay from the incident's own pace, and read what the number says about who has to be awake
- →Run the first hour from a written card: who is called, what is posted, what is closed, and what is recorded
Graduate · enrolled learners
This lesson opens with The OpenSea phishing, 19 February 2022.
- What happened
- As OpenSea migrated its marketplace to a new contract, users received a phishing email dressed as an OpenSea notice asking them to migrate their listings to the new contract within a window. The email's link led to a page that asked users to sign a message. Per later analyses, including Check Point's, the signature authorized an order under the marketplace's Wyvern contract that the attacker could complete and execute, transferring the signed NFTs to themselves. OpenSea's chief executive, Devin Finzer, first said 32 users had signed a malicious payload; later reporting put the number affected at 17. Finzer said the attacker held about $1.7 million in ETH from selling stolen NFTs, that rumors of a $200 million hack were false, and that he did not believe the incident was connected to the OpenSea website.
- The decision point
- The attack ran on the pace of the migration: a real deadline, real emails from the platform in the same week, and a signature that looked like the migration's own. The users who lost were the ones who acted in the window, and the public conversation in the first day was about whether the platform itself had been breached, with a rumor of a $200 million hack that the chief executive had to deny. In this lesson's reading, the one message that stops further signatures does not depend on that answer: do not sign anything that asks you to migrate, we did not send it. A community leader's first hour has a fixed shape whatever the incident, because the questions that matter in it, what is still happening and how do we stop it, are the same every time, and the questions that feel urgent, how did this happen and whose fault is it, are the ones the postmortem answers later.
- Recorded loss
- $1,700,000
What you will be able to answer
- →What happened to OpenSea users in February 2022?
- →What is the first hour for?
- →The first-hour card, in order?
- →Why does the containment message go before the cause is known?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://thehackernews.com/2022/02/hackers-steal-17-million-worth-of-nfts.html
- https://theopendao.medium.com/opensea-phishing-attack-19-february-2022-and-the-opendaos-response-4f71aa80578c
- https://fortune.com/2022/02/21/opensea-co-founder-phishing-attacker-crypto-selling-stolen-nfts/
Confidence high·Volatility medium·Reviewed 2026-09-14·Owner unassigned
Contested
Reports differ on the affected count (17 after an initial 32) and on the take, with $1.7 million the most cited figure for ETH realized from sales. Some accounts describe the signed messages as valid orders under the Wyvern contract with fields left blank, and Check Point described the signature as sending an atomicMatch_ request through the attacker's contract to OpenSea's. The chief executive said he did not believe the incident was connected to the OpenSea website. The 32 is his first public count (Fortune); the 17 is from later reporting (The Hacker News), and we did not find OpenSea's own revised statement. That the first hours were spent on whether the platform was breached, at the cost of the containment message, is this lesson's reading of the public record, not a documented finding.
F106-06 and O101-01 own the individual's first hour after a loss. This lesson owns the community leader's, which runs at the same time and has a different job.