Hackers steals $400K in NFTs from Premint users via malicious link Hackers steals $400K in NFTs from Premint users via malicious link
Blockchain security company, CertiK confirmed that the hackers stole over 300 NFTs, which included NFTs from prominent projects like BAYC, Goblintown, and Otherside.
2 min read
Updated: Jul. 23, 2022 at 2:37 pm UTC
Cover art/illustration via CryptoSlate. Image includes combined content which may include AI-generated content.
Popular NFT platform Premint suffered a hack on July 17, leading to total losses of around $400,000 for users who clicked on a malicious link.
According to available information, the hacker compromised Premint’s website by adding a malicious JS file to the site.ย Unsuspecting users who clicked on the link gave the hacker access to steal the NFTs in their wallets.
Over 300 NFTs lost
Blockchain security company Certik confirmed that the hackers stole 314 NFTs, which included NFTs from notable projects like Bored Ape, Goblintown, and Otherside.
We are actively working to get a full list of wallets that had assets taken from them.
These are the wallets that Etherscan have flagged for stealing assets.
–https://t.co/l3yEk2tUDs
– https://t.co/wdo7sJMia1
– https://t.co/8bBEgpKupN
– https://t.co/iY4tna437S— PREMINT | NFT Access List Tool (@PREMINT_NFT) July 17, 2022
Premint confirmed the hack and said that only a “relatively small number of users” were victimized and added that Etherscan had identified four wallets connected to the attack.
The total Ethereum (ETH) value of stolen assets is estimated to be 275 ETH, worth over $400,000.
๐Please do not sign any transactions that say set approvals for all! ๐
— PREMINT | NFT Access List Tool (@PREMINT_NFT) July 17, 2022
The attack occurred hours after Premint warned users not to “sign any transactions that say set approvals for all!”
Today we made a lot of great security updates to PREMINT as a continuing effort to keep collectors safe. It touched everything from the dashboard to project pages to emails. Here's a rundown:
๐งต
— Brendฮn Mulligan | PREMINT (@mulligan) July 8, 2022
Premint restores service
Premint has been able to restore normalcy to its website and has added an update that removes the wallet login feature.
Starting today, you donโt need your wallet when logging back in to PREMINT.
Now, once youโve connected your Twitter or Discord accounts to your wallet (https://t.co/rdjDd5qUcM), use them to log in to your account.
Itโs safer and way more convenient. Especially on mobile! pic.twitter.com/BSSyzx7zkj
— PREMINT | NFT Access List Tool (@PREMINT_NFT) July 18, 2022
Users can now log in to the platform via their Discord or Twitter social media accounts, which the platform claims is “safer and more convenient, especially for those logging in on mobile.”
PREMINT is safe to log into. You will see a gas-free signing confirmation screen when you connect your wallet.
We never, ever ask for any transaction access and you will never, ever see gas associated with connecting to PREMINT.
— PREMINT | NFT Access List Tool (@PREMINT_NFT) July 18, 2022
It also directed affected users to add their wallet address to a document.
If you were affected by the incident on PREMINT today, please add your wallet here: https://t.co/gvNiOyD24M
— PREMINT | NFT Access List Tool (@PREMINT_NFT) July 17, 2022
However, there is no information on how or when they would be refunded.
NFT hacks
The latest attack on Premint is the latest in a long line of hacks in the NFT space within a relatively short time.
๐จ๐จ๐จ๐จ
Be Safe.
DeeKayโs twitter is hacked. pic.twitter.com/qpZtlHF8UR— sean (@SeanOhio_) July 15, 2022
On July 15, famous NFT artist DeeKay lost $150,000 worth of NFTs to malicious players.
A Footprint Analytics report said around 5% of the total hacks in web3 during the second quarter of 2022 happened in NFTs.
Mentioned in this article
Author 
Oluwapelumi Adejumo
Oluwapelumi values Bitcoin's potential. He imparts insights on a range of topics like DeFi, hacks, mining and culture, underlining transformative power.
Latest Ethereum Stories
Featured Story
Advertise Here
In this article
Ethereum is a decentralized, open-source blockchain platform that enables the creation of smart contracts and decentralized applications (DApps).
CertiK
Founded in 2018 by professors of Yale University and Columbia University, CertiK is a pioneer in blockchain security, utilizing best-in-class AI technology to secure and monitor blockchain protocols and smart contracts.
Bored Ape Yacht Club
Bored Ape Yacht Club, or often colloquially called Bored Ape, is a non-fungible token collection built on the Ethereum blockchain.