If you’re in an NFT Discord, be careful of the links you click. A new scam sees hackers crack into NFT Discord bots to trick users into sending cryptocurrency to “mint” fake NFTs.
Bored Ape Yacht Club (BAYC), Nyoki, and Shamanz have all tweeted warnings to users that their Twitter bots have been hacked and are advertising new NFTs that are completely fake. Instead of taking users to legitimate NFT minting sites, the link directs users' crypto to a pair of crypto wallets that have been busily laundering their ill-gotten gains.
“Oh no, our dogs are mutating,” reads one message posted to the Bored Ape Yacht Club Discord (as verified by Vice). “MAKC can be staked for our $APE token. Holders of MAYC + BAYC will be able to claim exclusive rewards just by simply minting and holding our mutant dogs.”
Hackers are essentially performing a phishing scam, using the Discord bots to disguise the fake links as legitimate new offerings. Vice has confirmed that the links direct users to two crypto wallets that have been labeled Fake_Phishing5519 and Fake_Phishing5520 on blockchain explorer Etherscan, and that both wallets have been experiencing extensive activity over the past few days as the hackers attempt to launder their stolen cryptocurrency.
"STAY SAFE. Do not mint anything from any Discord right now. A webhook in our Discord was briefly compromised," reads a tweet from the BAYC Twitter. "We caught it immediately but please know: we are not doing any April Fools stealth mints/airdrops etc. Other Discords are also being attacked right now."
This isn’t the first time Discord bots of NFT channels have been targeted by hackers. A very similar hack happened to Twitch co-founder Justin Kan for his Fractal NFT project where 373 users had their cryptocurrency stolen.
Hackers seem to be targeting NFTs as the best get-rich-quick scheme on the internet. NFT game Axie Infinity was hacked recently thanks to a security breach on its blockchain. Hackers managed to steal around $600 million in crypto, although cybersecurity analysts have also identified the crypto wallets for where the stolen funds have been sent.