Curriculum·G705 Scam Response for Community Leaders·about 32 min
The first hour, at community scale
By the end of this lesson you can
- →State what happened to OpenSea users on 19 February 2022, how many were affected, what they had signed, and what it cost
- →Explain why the first hour of a community incident is spent on containment and one message, and why the postmortem waits
- →Compute the cost of an hour's delay from the incident's own pace, and read what the number says about who has to be awake
- →Run the first hour from a written card: who is called, what is posted, what is closed, and what is recorded
Graduate · enrolled learners
This lesson opens with The OpenSea phishing, 19 February 2022.
- What happened
- As OpenSea migrated its marketplace to a new contract, users received a phishing email dressed as an OpenSea notice asking them to migrate their listings to the new contract within a window. The email's link led to a page that asked users to sign a message. The message was a valid order under the marketplace's Wyvern contract with the price fields left blank, so that the attacker could later fill in the price and execute the transfer of the signed NFTs to themselves for nothing. OpenSea's chief executive first said 32 users had signed the malicious payload and later revised the count of affected users to 17. The attacker sold stolen tokens for about $1.7 million in ETH. OpenSea stated that its website and contracts had not been compromised and that the attack was phishing of individual users.
- The decision point
- The attack ran on the pace of the migration: a real deadline, real emails from the platform in the same week, and a signature that looked like the migration's own. The users who lost were the ones who acted in the window, and the community's first hour was spent working out whether the platform itself had been breached, which delayed the one message that would have stopped further signatures: do not sign anything that asks you to migrate, we did not send it. A community leader's first hour has a fixed shape whatever the incident, because the questions that matter in it, what is still happening and how do we stop it, are the same every time, and the questions that feel urgent, how did this happen and whose fault is it, are the ones the postmortem answers later.
- Recorded loss
- $1,700,000
What you will be able to answer
- →What happened to OpenSea users in February 2022?
- →What is the first hour for?
- →The first-hour card, in order?
- →Why does the containment message go before the cause is known?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://thehackernews.com/2022/02/hackers-steal-17-million-worth-of-nfts.html
- https://theopendao.medium.com/opensea-phishing-attack-19-february-2022-and-the-opendaos-response-4f71aa80578c
- https://fortune.com/2022/02/21/opensea-co-founder-phishing-attacker-crypto-selling-stolen-nfts
Confidence high·Volatility medium·Reviewed 2026-09-14·Owner unassigned
Contested
Reports differ on the affected count (17 after an initial 32) and on the take, with $1.7 million the most cited figure for ETH realized from sales. Some accounts describe the signed messages as valid orders under the Wyvern contract with fields left blank; the company described the attack as phishing and stated its contracts were not compromised.
F106-06 and O101-01 own the individual's first hour after a loss. This lesson owns the community leader's, which runs at the same time and has a different job.