Arthur_0x wrote on Twitter that they had previously only ever used a hardware wallet on their PC, but when they started more regularly trading NFTs they'd started using a hot wallet. "Hot wallet on mobile phone is indeed not safe enough", they wrote on Twitter, "Guess no more hot wallet usage then." They also wrote, "The only thing I can say to the hacker is: you mess with the wrong person" and tweeted the wallet address to which the NFTs were being transferred, asking for it to be blocklisted.
The hacker complicated things somewhat for OneRing by covering their tracks. They used a "self-destruct" mechanism — typically used by developers to destroy smart contracts that are found to have a bug — to destroy the contract they used to carry out the attack, making it more difficult for OneRing to determine which parts of their codebase were vulnerable and led to the attack.
- "OneRing Finance exploit. Post-mortem — After OShare Hack.", OneRing Finance blog
- Tweet thread by PeckShield
The Fried account compromise is only one instance of what has become a trend on Twitter: Twitter accounts belonging to high-profile individuals, or accounts that are verified or have a large number of followers, being compromised and sold to NFT scammers. On March 11, ESPN baseball reporter Jeff Passan also had his twitter account compromised and repurposed to shill Skulltoons NFTs. Skulltoons distanced themselves from that incident, writing that they believed the hackers were trying to scam their NFT community.
- "Hackers hijack Nikki Fried’s campaign Twitter account", Florida Politics
Kaiju Kongz NFT project artificially inflates its floor price by destroying your NFTs if you list them for sale at too low a price
Some NFT collectors criticized the choice. One described it as "illegal market manipulation tactics", and others said the project should grow the floor "organically". Given the rampant manipulation in the NFT space, one wonders if the real criticism collectors have with the project is that they were too transparent about their price manipulation, and should've just done it quietly like other projects have.
Founder of crypto investment scheme "IGObit" and the sham organization "World Sports Alliance" is convicted of wire fraud
- "President Of Sham United Nations Affiliate Convicted Of Cryptocurrency Scheme", U.S. Attorney’s Office, Southern District of New York
People were somewhat split on whether this could be classed as a vulnerability in the $APE airdrop, since (as with many crypto hacks and scams) the person was operating completely within the rules set out in code.
Australian regulatory agency begins lawsuit against Facebook over failing to address scammy crypto ads
- "ACCC takes action over alleged misleading conduct by Meta for publishing scam celebrity crypto ads on Facebook", Australian Competition & Consumer Commission
Binance says it will stop operating in Ontario, for real this time, and admits they lied to investors
On March 16, Binance confirmed that they would actually stop servicing Ontario residents, for real this time. They also admitted to sending an email to investors on January 1 that said that they could no longer trade or onboard to the platform, despite not putting any such restriction in place.
- "Binance tells regulators it will cease operations in Ontario... for real this time", Cointelegraph
- "Binance is not registered in Ontario", Ontario Securities Commission
Not only did the attackers post a fake mint link, they took steps to prevent the project from thwarting their attack by banning other members and removing user rights that would have allowed other project members to delete the fake links. They also added a bot to the server that locked channels so people couldn't send warnings that the links were fake.
The Rare Bears team did eventually regain access and secured their Discord server. In an apology posted on their Twitter page, they addressed the multiple security breaches that Rare Bears have faced to date, and said they had "stepped up" and would be having a firm audit their project.
The $APE price briefly soared to around $40 shortly after launch, before crashing precipitously to around $8.50 not long after, presumably as people cashed out their free money. Even many cryptocurrency enthusiasts were nonplussed by the launch, with many describing it as a "money grab" or an attempt to enrich the founders, which apparently is a bad thing (despite many crypto projects openly doing the same). One angry Redditor wrote, "Owners of Bored Ape NFTs were given the coin first(very rich people), then it was sold to the normies who got FOMO and pumped the price, then it crashed. Yet again, leaving regular people holding bags of pure garbage while the coin pushers wave bye-bye from their lambos."
- "Everybody Is Mad About 'ApeCoin'", Vice
- "This APE fiasco is just about getting the founders rich" from r/CryptoCurrency
- Tweet by kevwuzy
Fortunately there doesn't actually appear to be much to the project yet — actually creating a platform and an app to allow people to borrow books doesn't come until the fifth and sixth stages of their roadmap. The project is currently on the fourth step, and has been focusing their attentions on things like "marketing campaign" (stage 1), "aggressive marketing rollout" (stage 2), and "extreme marketing campaign" (stage 3). The stage 3 "extreme marketing campaign" also came with a "website relaunch", which we have to thank for one of the most outrageous pie charts I have ever seen (pictured) (which was later determined to have been a stock photo of a pie chart where they'd just changed the numbers). Perhaps they should focus some of their marketing efforts on coming up with answers to the simplest of questions that they should probably expect from authors — the type of people they're claiming to help.
Hundred and Agave were the second and third defi protocols targeted by flash loan attacks that same day, with Deus Finance losing more than $3 million to hackers using the same class of exploit.
Invictus DAO whales quickly vote to shutter the project in its first ever community vote, leaving most others with huge losses
However, although the project enjoyed a spike in price in November, the token has bled value since then. On March 9, the project leaders began a conversation about team salaries, where they also floated the idea of redeeming the treasury and closing the project. On March 11 they began a vote, which lasted only three days, and allowed members of the DAO to vote on whether the project should close and distribute treasury funds to participants. Much like the Wonderland vote in late January, a relatively small number of whales with a large share of the votes (who bought in early and still stood to make money on the project) were able to pass the vote to close the project, despite a majority of voters selecting to keep the project going. Furthermore, because the Invictus tokens used for voting also themselves hold the value, some people were unable to vote in the poll because their tokens were locked up in lending platforms where they had used them as collateral. Many participants in the project who haven't been actively watching the governance page likely don't even know the vote happened.
Some members of the project wrote on Discord that they felt rugged, with one even speculating that the project had been so eager to implement voting so they could pass a "community" vote to close the project and make off with a profit without damaging their reputations or potentially facing lawsuits. Various members of the project Discord shared how much they had lost: one person said they were down $20,000, another was down $75,000, and a third person reported losing $400,000. One person asked "who else is in the 6 figure loss club" and received three agreement emoji reactions; another person said they'd lost a year's salary. Some people already opted to try to sell their tokens early, worrying that the project leaders might make off with the treasury and not allow people to redeem their $IN; others waited in hopes of the redemption price being higher than the current token price; and some even suggested buying more $IN in hopes that they could make a profit if the redemption price is higher than the current price.
- [RFC] Allocate Funds for Team / Operational Expenses + Third Option on Invictus DAO forums
- [INIP] Allocate Funds for Team / Operational Expenses + Redemption on Invictus DAO forums
Discord compromise targets fans of the Wizard Pass project in a two-for-one scam that both accepted payments for fake NFTs and stole the NFTs that victims already owned
A Twitter thread by SerpentAU suggested that the malicious minting website had not only accepted ETH from victims and provided nothing in return, but had also prompted users to grant full access to their NFT wallet, allowing valuable NFTs to be stolen. It's not yet clear how many NFTs were stolen as a result.
Collector sues artist after spending over $500,000 on an image of Pepe the Frog that others got for free
A trader reportedly makes half a million from a flash crash, then the LATOKEN exchange takes their coins
Report alleges Socios withheld payments owed to advisors and staff to maintain the value of its cryptocurrency
One company now owns three of the most popular NFT collections: Bored Apes, CryptoPunks, and Meebits
Facebook bans crypto scammer who pulled in up to $140,000 by impersonating economist David Rosenberg
ESPN baseball reporter Jeff Passan has his Twitter account hacked and used to shill NFTs on "the biggest news day of [his] life"
Passan regained control of his Twitter account several hours later. Passan later wrote in a tweet, "hey remember that time i got hacked on the biggest news day of my life". The Skulltoons project distanced themselves from the incident, writing that they believed the hackers were trying to scam the Skulltoons community.
After someone games the system to acquire a disproportionate amount of airdropped tokens valued at $123 million, Juno community begins a vote to take them away
On March 10, a community proposal was submitted, proposing to take away the majority of the whale's tokens (worth around $121 million), and leave them with the 50,000 $JUNO (a little below $2 million) that was originally intended to be the maximum per person. The vote passed, in a major blow to an ecosystem where "your keys, your coins" is taken as gospel — that is, if you control the keys to a wallet, your assets supposedly can't be taken from you.
Bored Apes team asks people to verify their identities for their next project, shortly after making a stink about their own identities being revealed
There was some irony in BAYC requiring their buyers to reveal their identities only a month after some of the BAYC founders' identities were revealed by a journalist (who made the connection based on publicly-available information), which made the BAYC team and many of their supporters absolutely irate.
Entrepreneurs resuscitate 20-year-old piracy powerhouse LimeWire to turn it into a totally legitimate NFT marketplace, they promise
NFT project created and endorsed by various English footballers plunges in value, players try to quietly delete endorsements
The plummeting price is not the only problem the project has faced; shortly after Terry announced the project in January, he was threatened with legal action by the Premier League, and had to remove depictions of Premier League, UEFA and FA trophies, as well as the Chelsea logo, from the NFT illustrations.
Reddit users from the UK, Germany, France, and Switzerland reported receiving the email, and those countries now all appear on the 40-entry-long list of countries not permitted to use Crypto.com's lending services. One Reddit user wrote, "I have 7 days to pay a big loan, like big. If it gave us a month I could unstake and pay, but no, they give us 7 [days], I will get liquified and can't do anything for it." Other users were confused to receive the email when they didn't have any loans on the platform, as it was worded in a way that they interpreted to mean they did.
- "Crypto.com Tells Loan Customers in 'Excluded' Countries to Repay by March 15", CoinDesk
- Tweet thread by Bitfinexed
- "Just a week after the ‘Earn’ debacle, Crypto.com fucks up again by announcing that anyone with a Crypto Loan needs to repay it within 7 days – or be forcibly liquidated via funds in their Spot Wallet. What planet are these idiots living on?" from r/Crypto_com
Ormeus Coin founder charged with securities fraud for misrepresenting cryptomining operations and other assets
- "John Barksdale Charged With Cryptocurrency Securities Fraud In Connection With Sale Of Ormeus Coin", U.S. Attorney’s Office, Southern District of New York
- SEC v. Barksdale
Founders of several 2017 cryptocurrency companies indicted for alleged theft of more than $40 million
- "Owners and Operators of Online Cryptocurrency Companies Indicted for Defrauding Investors", U.S. Attorney’s Office, Eastern District of New York
Over 10,000 NFTs of photographs by August Sander are delisted from OpenSea after being created without permission
The problem with this whole scheme is that Julian Sanders does not actually control the Sander estate — it was sold in 1992 by Gerd Sander (August's grandson, and Julian's father) to the Cultural Foundation of the Stadtsparkasse Cologne. That group was surprised to see all of Sander's work suddenly being sold as NFTs without their permission, and submitted a legal notice to have it taken down from OpenSea. OpenSea complied with the request on March 7. After almost two weeks of stalling and deflecting questions about the delisting without even acknowledging the cause, Fellowship and Julian Sander finally released a statement on the issue on March 18. Sander wrote that "a third party... claims to have certain rights in August Sanders' photographs" but that he "believe[s] the complaint is not valid" and would be working with his lawyers to have the collection reinstated. As best as I can tell, it seems that Sander is trying to argue he is entitled to sell his great-grandfather's work as NFTs because he physically possesses the negatives, despite the fact that the Cultural Foundation owns the usage rights to all of Sander's work.
Influencer Jake Paul alleged to be repeatedly promoting projects without disclosing his financial involvement
Paul allegedly tried to cover his steps by creating a new crypto wallet to receive payments for each promotion, but then transferred the money a wallet he controlled to cash out. Oops. Some of the projects that Paul hyped in his undisclosed promotions included League of Sacred Devils, $MILF, and $YUMMY.
- "Exposing Jake Paul's Scams", YouTube video by CoffeeZilla
Some people in the crypto community responded with disdain at the project, describing it as a "cash grab". One NFT influencer tweeted "Hey @tailopez legit question: Why Would I pay 30-40k to watch a movie with you? or 80-90k for your WhatsApp? Who u think u are? U def have a shady reputation and doing this only adds more fuel to the fire. I respect anyone wanting to add value to NFTs but this is not the way." Others were surprised at the project's smart contract, which not only automatically transfers any money out of the project and into the team members' wallets, but requires the NFT buyer to pay the gas fee for that transaction in addition to normal gas fees for minting.
Nemus Earth plans to buy and protect land in the rainforest... with Ethereum NFTs and a Brazil nut plantation
The whitepaper also addresses that the project will be built on the Ethereum blockchain. There is a section about "pros & cons of Ethereum", which has one section: gas fees. Apparently the project based on environmental conservation has decided to simply gloss over the enormous energy consumption, emissions, and electronic waste stemming from the Ethereum blockchain.
The project opened its second round of minting on March 3, and is offering its NFTs for mint prices between 0.06 ETH and 19.44 ETH ($150 to $50,000).
OpenSea said in a statement that "OpenSea blocks users and territories on the U.S. sanctions list from using our services", though it's unclear why this change seems to only have come into effect recently.
Some Venezuelan users were furious with MetaMask, feeling that their choice to prevent them from using the platform was incompatible with the decentralized and deregulated nature of much of crypto. One Twitter user wrote, "MetaMask Do not tell me that you became Centralized, I have this problem and many people in Venezuela have the same".
ConsenSys later appeared to say that the block of Venezuelan users was in error, writing that "In changing some configurations as a result of the new sanctions directives from the United States and other jurisdictions mistakenly configured the settings more broadly than they needed to be".