OpenSea Vendor Leak Causes Over 7 Million Emails to be Publicised Now

Some repercussions take time to unfold, and OpenSea's 2022 data leak is a prime example.

More than seven million email addresses compromised in the breach have now been fully exposed online, creating new opportunities for scammers, warns a SlowMist executive.

SlowMist's chief information security officer, "23pds," wrote in a recent post:

“Remember the attack on the OpenSea mail service provider in [2022] that led to the leakage of emails? The leaked email addresses have now been fully publicized after multiple disseminations.”

According to security researcher 23pds, while the attack occurred in June 2022, the data was only recently made public—making it a fresh target for phishing and fraud attempts by malicious actors.

23pds noted:

“Previously, it was not made public. Now all the leaked data has been made public in its entirety and is available to anyone who wants it.”

In a post originally written in Mandarin, 23pds added:

“The amount of leaked data reached 7 million, including a large number of email information of overseas cryptocurrency practitioners, including many well-known people, companies and key opinion leaders (KOLs) in the industry.”

OpenSea's 2022 Data Leak

On 29 June 2022, OpenSea, one of the world's largest NFT marketplaces, alerted users to a data breach after discovering that an employee of its email automation provider, Customer.io, had leaked customer email addresses to an external party.

It had noted at the time:

“If you have shared your email with OpenSea in the past, you should assume you were impacted. We are working with Customer.io in their ongoing investigation, and we have reported this incident to law enforcement.”

Phishing Attack Prevention

23pds urged those affected by the OpenSea email leak to take immediate precautions.

They advised using strong, unique passwords stored securely in a password manager and enabling two-factor authentication (2FA)—preferably via an authenticator app rather than SMS.

Keeping device software up to date was also emphasized as a crucial security measure.

Phishing scams remained one of the biggest threats in 2024, with attackers stealing over $1 billion in digital assets across 296 incidents, according to CertiK.

A CertiK spokesperson had expressed:

“Phishing was the most costly attack vector last year. Our figures are conservative, the actual figure is higher when you consider unreported incidents and other types of phishing scams like pig butchering.”

Preventing phishing scams is all about staying alert and cautious.

In short, always verify URLs before logging in, never click suspicious links, and enable 2FA for extra security.

Be cautious of urgent messages pressuring you to act and never share your private keys or seed phrase.

Use hardware wallets to keep assets safe, and watch out for fake social media accounts posing as crypto exchanges or support teams.

Regularly update your software to protect against new threats, and if something feels off, triple-check before taking action.