Rose

Kevin

Simply

Security

Disclosure: The views and opinions expressed here belong solely to the author and do not represent the views and opinions of crypto.news’ editorial. 
The <a href="https://crypto.news/what-nft-why-they-rise/" rel="noopener noreferrer nofollow">non-fungible token</a> (NFT) space spares no one, not even those who <a href="https://twitter.com/NFT_GOD/status/1614442000958324739?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1614442000958324739%7Ctwgr%5E5967e7fab348c291670359a35411d765908ae814%7Ctwcon%5Es1_&amp;ref_url=https%3A%2F%2Fhacken.io%2Fdiscover%2Fnft-scams%2F" target="_blank" rel="noopener noreferrer nofollow">call</a> themselves NFT God. An experienced investor like Kevin Rose also got <a href="https://twitter.com/ArkhamIntel/status/1618336268513075202" target="_blank" rel="noopener noreferrer nofollow">duped</a> in early-2023, losing NFTs worth $1 million or more. Cracks like these betray the troubled state of NFT security across platforms. Over 13,650 NFTs have been <a href="https://dune.com/queries/1906701/3155486" target="_blank" rel="noopener noreferrer nofollow">stolen</a> since mid-2021, amounting to over $29.5 million. 
Leading NFT marketplaces are adopting and implementing processes to mitigate thefts and scams, or at least minimize their impact, but with very limited scope. It mostly involves some compromise, either on the part of creators or victims.&nbsp; 
 You might also like: <a href="https://crypto.news/nft-theft-decreased-20-in-july-report/ " rel="noopener noreferrer nofollow"> NFT theft decreased 20% in July: report </a> 
There’s much debate around whether creators must compensate users who suffer NFT thefts. But one considerable aspect is that the stakes of swiping and flipping NFTs — especially the big, “blue chip” ones — are pretty high. So phishers constantly up their game and stopping them is a tough challenge.&nbsp; 
It’s thus high time to revisit a very basic question — why does someone steal NFTs? To sell them for profit. And that’s also a soft spot for malicious actors. Their efforts are futile if not profitable. Most scammers will change their livelihood if they’re unable to sell stolen NFTs easily for good prices and without accountability. 
This’ll be possible only with collective effort though. Any one marketplace or security company or developer can’t stop NFT scams and thefts. Industry stakeholders must collaborate to block the thieves’ profit-making pathways, much like stopping viruses in the human body. 
<h2 class="wp-block-heading" id="strong-behind-the-scenes-of-nft-thefts-strong">Behind the scenes of NFT thefts</h2> 
Robbie Acres’s case is an eye-opening <a href="https://beincrypto.com/opensea-nft-victim-plans-to-get-justice/" target="_blank" rel="noopener noreferrer nofollow">example</a> of what happens when NFTs are stolen, even on leading marketplaces like OpenSea. It was most likely a phishing attack, targeting two NFTs from the HAPE PRIME and Karafufu collections. 
Though Robbie and his lawyers believe there was enough scope to stop the stolen NFTs from being resold, the marketplace sent a “delayed response” conveying their inability to recover the lost assets.&nbsp; 
The situation escalated into a full-on legal battle, even with allegations about OpenSea freezing Robbie’s account for several months. But what’s more prominent here is how marketplaces as big as OpenSea can’t stop: one, NFT thefts, and two, the sale of stolen NFTs.&nbsp; 
One shouldn’t completely blame them either. Given the current security models, there’s only so much a marketplace can do in the fight against attackers. OpenSea, for one, has put the effort into <a href="https://opensea.io/blog/articles/our-efforts-to-prevent-nft-theft" target="_blank" rel="noopener noreferrer nofollow">devising</a> a comprehensive anti-theft policy for NFTs. They’ve even implemented systems to automatically detect and block stolen NFTs, as well as disable scam links as such. Though it’s clearly not working.&nbsp; 
<h2 class="wp-block-heading" id="strong-finding-a-needle-in-the-haystack-strong">Finding a needle in the haystack</h2> 
OpenSea, or any individual marketplace for that matter, isn’t the only place where NFT thieves can sell off their exploits. There are many ways out. And there are even more unwitting buyers who ultimately receive the stolen NFTs. 
The unaware buyer is also at the receiving end of increasing NFT scams — i.e., the second key victim after the original owner. Scammers are often smart enough to offer irresistible deals on stolen NFTs because whatever they get is currently more than their cost of attack, and hence profitable. But the buyer essentially receives zero value and can also land in trouble for no fault of theirs.&nbsp; 
At the same time, constantly monitoring and tracing NFT transactions isn’t a viable option as it conflicts with decentralized principles like autonomy, privacy, etc. That’s partly why relying solely on marketplaces to tackle NFT thefts is a naive over-expectation. They can offer a bunch of compromises and consolations at best.&nbsp; 
On a very practical level, catching stolen NFTs once they start moving across brimming terrains is like finding a needle in the haystack. Simply asking users to exercise caution or avoid getting phished isn’t enough either. Especially when industry experts like Robbie, Kevin, and NFT God are on the victim list. 
<h2 class="wp-block-heading" id="strong-focusing-on-the-unwitting-part-strong">Focusing on the “unwitting” part</h2> 
So much to pinpoint the problem. Now for the solution, it’s important to see that stopping NFT thefts requires a two-tier effort. First, promptly identifying stolen NFTs. Second, stopping their post-theft resales. 
Security innovators like Zengo and Forta, among others, have built robust preventive analysis and threat detection models that can identify NFT attacks in real time. For instance, Forta’s NFT Threat Detection Kit has multiple detector bots to analyze anomalous transfers, abnormal transaction volumes, ice phishing incidents, exploiter address interactions, and so on.&nbsp; 
They can also send real-time alerts to subscribing end-users and marketplaces. But when it’s about acting on these alerts, the current framework is still too slow and sloppy. Now imagine a scenario where stolen NFTs are promptly and clearly earmarked as such, letting everyone know their nature. Except perhaps some darknet participants, who’d be willing to buy ‘stolen’ NFTs for a premium?&nbsp; 
An NFT scammer’s business model collapses the moment we introduce accountability into the picture. Because they primarily leverage the buyer’s lack of knowledge that a particular NFT is stolen or compromised in some other way. And as defenders of NFT value, we must also focus on the “unwitting” part — that’s a key to solving the crisis at hand.&nbsp; 
Putting a persistent ‘stolen’ tag on such NFTs hampers the profitability of scams by making the cost of attack more than flipping returns. Ideally, reselling stolen NFTs must fetch less than the gas fees for scam transactions — that’ll completely tip the odds against scammers. And as the time-tested resilience of, say, the Bitcoin network proves, economic disincentive is ultimately the best deterrent for attackers.&nbsp; 
<h2 class="wp-block-heading" id="strong-the-call-for-industry-wide-collaboration-strong">The call for industry-wide collaboration</h2> 
Coupled with smart attack detectors, effective flagging mechanisms for stolen NFTs will make scams less common. They’ll enable the holistic defense mechanism necessary in this regard. But while such innovations lay the technical foundation, there’s a crucial social factor at work.&nbsp; 
Especially marketplaces, but also other industry participants, must adopt and implement the said capabilities in unison. There can’t be any gaps for thieves to evade — stopping them for good requires a complete lockdown.&nbsp; 
That’s when the profit from NFT scams will be the lowest, i.e., the point where we can safely call NFTs safe, at least from a specific point of view. 
 Read more: <a href="https://crypto.news/from-millions-to-pennies-the-astonishing-decline-of-iconic-nfts/ " rel="noopener noreferrer nofollow"> From millions to pennies: the astonishing decline of iconic NFTs </a> 
 Author: Christian Seifert 
Christian Seifert is the researcher-in-residence at Forta. Prior to joining Forta, Christian spent 14 years at Microsoft leading security research and applied research teams supporting Microsoft Defender security offerings. Christian also led The Honeynet Project, a global non-profit security research organization bringing passionate security researchers together working on open-source honeypot tool development and threat intelligence.

No room for compromise: marketplaces must do more to tackle stolen NFTs | Opinion

Table of Contents

crypto.news

Other articles published on Aug 20, 2023

Unlocking Unique Value With Bitcoin Ordinals, Shiba Inu’s Shibarium, And Big Eyes Infinity

What is 'Friend Tech'? The Impact of Paradigm's Endorsement & the Rise of Decentralized Social Ne...

Crypto Adoption In South Korea Continues To Grow With Kakao

Will You Ever Buy Lunch With Bitcoin?

Exploring the Landscape: Crypto’s Evolution Towards Cross-Chain, Multichain And Omnichain Models

Three Wallets Dubbed “Smart Whales” Buy Huge Ethereum at Similar Price Levels

Join our free newsletter for daily crypto updates!