Rose

Security

Read

Simply

<div class="cryptonews"> 
 <div class="cn-block-disclaimer"> 
  <div class="cn-block-disclaimer__icon"> 
   <svg class="icon icon-info" aria-hidden="true"> <use xlink:href="#"></use> 
   </svg> 
  </div> 
  <p class="cn-block-disclaimer__content"> Disclosure: The views and opinions expressed here belong solely to the author and do not represent the views and opinions of crypto.news’ editorial. </p> 
 </div> 
 <p>The non-fungible token (NFT) space spares no one, not even those who call themselves NFT God. An experienced investor like Kevin Rose also got duped in early-2023, losing NFTs worth $1 million or more. Cracks like these betray the troubled state of NFT security across platforms. Over 13,650 NFTs have been stolen since mid-2021, amounting to over $29.5 million.</p> 
 <p>Leading NFT market<a rel="noopener noreferrer nofollow" title="place" href="https://thebittimes.com/tag/place.html">place</a>s are adopting and implementing processes to mitigate thefts and scams, or at least minimize their impact, but with very limited scope. It mostly involves some <a rel="noopener noreferrer nofollow" title="compromise" href="https://thebittimes.com/tag/compromise.html">compromise</a>, either on the part of creators or victims.&nbsp;</p> 
 <div class="cn-block-related-link"> 
  <svg class="cn-block-related-link__icon icon" aria-hidden="true"> <use xlink:href="#"></use> 
  </svg> <span class="cn-block-related-link__prefix"> You might also like: </span> NFT theft decreased 20% in July: report 
 </div> 
 <p>There’s much debate around whether creators must compensate users who suffer NFT thefts. But one considerable aspect is that the stakes of swiping and flipping NFTs — especially the big, “blue chip” ones — are pretty high. So phishers constantly up their game and stopping them is a tough challenge.&nbsp;</p> 
 <p>It’s thus high time to revisit a very basic question — why does someone steal NFTs? To sell them for profit. And that’s also a soft spot for malicious actors. Their efforts are futile if not profitable. Most scammers will change their livelihood if they’re unable to sell stolen NFTs easily for good prices and without accountability.</p> 
 <p>This’ll be possible only with collective effort though. Any one market<a rel="noopener noreferrer nofollow" title="place" href="https://thebittimes.com/tag/place.html">place</a> or security company or developer can’t stop NFT scams and thefts. Industry stakeholders must collaborate to block the thieves’ profit-making pathways, much like stopping viruses in the human body.</p> 
 <h2 class="wp-block-heading" id="strong-behind-the-scenes-of-nft-thefts-strong"><strong>Behind the scenes of NFT thefts</strong></h2> 
 <p>Robbie Acres’s case is an eye-opening example of what happens when NFTs are stolen, even on leading marketplaces like OpenSea. It was most likely a phishing attack, targeting two NFTs from the HAPE PRIME and Karafufu collections.</p> 
 <p>Though Robbie and his lawyers believe there was enough scope to stop the stolen NFTs from being resold, the marketplace sent a “delayed response” conveying their inability to recover the lost assets.&nbsp;</p> 
 <p>The situation escalated into a full-on legal battle, even with allegations about OpenSea freezing Robbie’s account for several months. But what’s more prominent here is how marketplaces as big as OpenSea can’t stop: one, NFT thefts, and two, the sale of stolen NFTs.&nbsp;</p> 
 <p>One shouldn’t completely blame them either. Given the current security models, there’s only so much a marketplace can do in the fight against attackers. OpenSea, for one, has put the effort into devising a comprehensive anti-theft policy for NFTs. They’ve even implemented systems to automatically detect and block stolen NFTs, as well as disable scam links as such. Though it’s clearly not working.&nbsp;</p> 
 <h2 class="wp-block-heading" id="strong-finding-a-needle-in-the-haystack-strong"><strong>Finding a needle in the haystack</strong></h2> 
 <p>OpenSea, or any individual marketplace for that matter, isn’t the only place where NFT thieves can sell off their exploits. There are many ways out. And there are even more unwitting buyers who ultimately receive the stolen NFTs.</p> 
 <p>The unaware buyer is also at the receiving end of increasing NFT scams — i.e., the second key victim after the original owner. Scammers are often smart enough to offer irresistible deals on stolen NFTs because whatever they get is currently more than their cost of attack, and hence profitable. But the buyer essentially receives zero value and can also land in trouble for no fault of theirs.&nbsp;</p> 
 <p>At the same time, constantly monitoring and tracing NFT transactions isn’t a viable option as it conflicts with decentralized principles like autonomy, privacy, etc. That’s partly why relying solely on marketplaces to tackle NFT thefts is a naive over-expectation. They can offer a bunch of compromises and consolations at best.&nbsp;</p> 
 <p>On a very practical level, catching stolen NFTs once they start moving across brimming terrains is like finding a needle in the haystack. Simply asking users to exercise caution or avoid getting phished isn’t enough either. Especially when industry experts like Robbie, Kevin, and NFT God are on the victim list.</p> 
 <h2 class="wp-block-heading" id="strong-focusing-on-the-unwitting-part-strong"><strong>Focusing on the “unwitting” part</strong></h2> 
 <p>So much to pinpoint the problem. Now for the solution, it’s important to see that stopping NFT thefts requires a two-tier effort. First, promptly identifying stolen NFTs. Second, stopping their post-theft resales.</p> 
 <p>Security innovators like Zengo and Forta, among others, have built robust preventive analysis and threat detection models that can identify NFT attacks in real time. For instance, Forta’s NFT Threat Detection Kit has multiple detector bots to analyze anomalous transfers, abnormal transaction volumes, ice phishing incidents, exploiter address interactions, and so on.&nbsp;</p> 
 <p>They can also send real-time alerts to subscribing end-users and market<a rel="noopener noreferrer nofollow" title="place" href="https://thebittimes.com/tag/place.html">place</a>s. But when it’s about acting on these alerts, the current framework is still too slow and sloppy. Now imagine a scenario where <a rel="noopener noreferrer nofollow" title="stolen" href="https://thebittimes.com/tag/stolen.html">stolen</a> NFTs are promptly and clearly earmarked as such, letting everyone know their nature. Except perhaps some darknet participants, who’d be willing to buy ‘<a rel="noopener noreferrer nofollow" title="stolen" href="https://thebittimes.com/tag/stolen.html">stolen</a>’ NFTs for a premium?&nbsp;</p> 
 <p>An NFT scammer’s business model collapses the moment we introduce accountability into the picture. Because they primarily leverage the buyer’s lack of knowledge that a particular NFT is stolen or compromised in some other way. And as defenders of NFT value, we must also focus on the “unwitting” part — that’s a key to solving the crisis at hand.&nbsp;</p> 
 <p>Putting a persistent ‘stolen’ tag on such NFTs hampers the profitability of scams by making the cost of attack more than flipping returns. Ideally, reselling stolen NFTs must fetch less than the gas fees for scam transactions — that’ll completely tip the odds against scammers. And as the time-tested resilience of, say, the Bitcoin network proves, economic disincentive is ultimately the best deterrent for attackers.&nbsp;</p> 
 <h2 class="wp-block-heading" id="strong-the-call-for-industry-wide-collaboration-strong"><strong>The call for industry-wide collaboration</strong></h2> 
 <p>Coupled with smart attack detectors, effective flagging mechanisms for stolen NFTs will make scams less common. They’ll enable the holistic defense mechanism necessary in this regard. But while such innovations lay the technical foundation, there’s a crucial social factor at work.&nbsp;</p> 
 <p>Especially marketplaces, but also other industry participants, must adopt and implement the said capabilities in unison. There can’t be any gaps for thieves to evade — stopping them for good requires a complete lockdown.&nbsp;</p> 
 <p>That’s when the profit from NFT scams will be the lowest, i.e., the point where we can safely call NFTs safe, at least from a specific point of view.</p> 
 <div class="cn-block-related-link"> 
  <svg class="cn-block-related-link__icon icon" aria-hidden="true"> <use xlink:href="#"></use> 
  </svg> <span class="cn-block-related-link__prefix"> Read more: </span> From millions to pennies: the astonishing decline of iconic NFTs 
 </div> 
 <div class="cn-block-author author-card"> 
  <div class="author-card__photo"> 
   <img decoding="async" src="https://crypto.news/app/uploads/2023/08/Christian_Seifert_Headshot_BW.jpg" width="370" height="370" alt="Christian Seifert" class="author-card__image"> 
  </div> 
  <div class="author-card__content"> 
   <div class="author-card__name">
     Christian Seifert 
   </div> 
   <div class="author-card__bio"> 
    <p><b>Christian Seifert</b><span style="font-weight: 400;"> is the researcher-in-residence at Forta. Prior to joining Forta, Christian spent 14 years at Microsoft leading security research and applied research teams supporting Microsoft Defender security offerings. Christian also led The Honeynet Project, a global non-profit security research organization bringing passionate security researchers together working on open-source honeypot tool development and threat intelligence.</span></p> 
   </div> 
   <div class="author-card__social"> 
    <svg class="community-link__icon" aria-hidden="true"> <use xlink:href="#"></use> <use xlink:href="#"></use> 
    </svg> <span class="community-link__label screen-reader-text"> LinkedIn </span> 
    <svg class="community-link__icon" aria-hidden="true"> <use xlink:href="#"></use> <use xlink:href="#"></use> 
    </svg> <span class="community-link__label screen-reader-text"> Twitter </span> 
   </div> 
  </div> 
 </div> 
 <p></p> 
 <p></p> <span class="google-news-banner__label">Follow Us on Google News</span> 
</div>

No room for compromise: marketplaces must do more to tackle stolen NFTs | Opinion

Table of Contents

TheBitTimes

Other articles published on Aug 20, 2023

Exploring the Landscape: Crypto’s Evolution Towards Cross-Chain, Multichain And Omnichain Models

Three Wallets Dubbed “Smart Whales” Buy Huge Ethereum at Similar Price Levels

Why Bitcoin Going Over $4k Is A Good Sign For Crypto

What Are Atomic Swaps And How Do They Work?

Scalability Focus Puts Kaspa ($KAS) in League with ETH and ADA

Coinbase enters Canada, Shibarium faces post-launch hurdles, adoption maintains momentum | Weekly...

Join our free newsletter for daily crypto updates!