Animoca to Compensate Users for 265 ETH Stolen in Discord Attack

Hong Kong-based gaming and venture capital firm Animoca Brands and subsidiary Blowfish Studios have promised users they will pay back 265 ETH ($1.1 million) stolen in a fraudulent NFT sale on D`iscord.

The fraudulent minting incident took place on the Phantom Galaxies Discord server on November 19 at approximately 3:00AM AEST. Over the course of about three hours, it saw 1,571 fake minting transactions.

Phantom Galaxies is an upcoming Australian game from Blowfish Studios. The Phantom Galaxies Discord server has 94,000 members.

An increasingly common occurrence on Discord is for hackers to take control of the official Phantom Galaxies servers by using malware bots that compromised two-factor authentication for admin accounts. Once in control of the Discord server, the hackers banned the accounts of all staff, advisors, and community moderators.

The hackers then began making announcements, claiming that the game would immediately launch a surprise “stealth” NFT minting event. Users were directed to a fraudulent “Phantom Galaxies NFT minting platform” that charged users a “minting fee” of 0.1 ETH.

Around 4 a.m. ET on Nov. 19, Yat Siu, chairman of Animoca Brands, tweeted to warn fans about the fraudulent NFT drop.

In another tweet at 5:22 a.m., he said affected customers would be "appropriately compensated." Animoca has since confirmed this in a Nov. 24 release, which said details about the compensation will be announced soon.

“Woodz,” the California project manager for upcoming NFT project Terra Obscura, lost $1,000 in the attack. They told Cointelegraph that they realized they had been scammed shortly after “minting” two non-existent NFTs:

"When I was working on it, it seemed to be a bit off. The gas fee was unusually low and the contracts looked different. I knew something was wrong, but not sure what."

Woodz added that they "don't usually click on random links," but because the announcement was placed within the official announcement channel, they fell into the trap of the hackers.

The attack on Phantom Galaxies follows a similar attack recently on Nov. 11 involving renowned NFT artist Beeple. Users thought they were signing up for a very affordable NFT airdrop, timed to coincide with his second Christie’s auction.

The perpetrator impersonated a channel admin and Beeple Announcement Bot to promote a fake NFT video from Beeple on Nifty Gateway. Beeple has since removed the link to Discord from his Twitter profile, and other links to the server no longer appear to work.

Discord is becoming an increasingly popular platform for cybercriminals, according to an Oct. 21 report from cybersecurity firm RiskIQ. Researchers at RiskIQ discovered 27 unique malware types hosted on Discord's CDN servers.

In April, Talos Intelligence similarly found that hackers were increasingly using platforms like Discord to take advantage of users who were at home due to global COVID-19 restrictions.

"Attackers are leveraging collaboration platforms, such as Discord and Slack, to stay under the radar and evade organizations' defenses," it wrote at the time.