Opensea
Hack or exploit on Oct 28, 2022 · Contract Vulnerability
What happened
Browser security plug-in Pocket Universe tweeted that a new vulnerability was discovered in Opensea’s old contracts that could be used to steal users’ NFTs, potentially emptying wallets once the transaction was signed. It can steal any NFT users listed on Opensea before May 2022 (i.e. before Seaport upgrades), mainly involving the Wyvern protocol, which grants proxy contracts the right to withdraw user NFTs, and this new exploit will Trick the user into signing a transaction, giving the attacker ownership of the user's proxy contract. Cosine, the founder of SlowMist, tweeted that it is necessary to be vigilant about the new use of this old problem, which is related to the old OpenSea protocol, but many users of the old protocol have not cancelled the relevant authorization, and this use is invalid for the new OpenSea protocol (Seaport).
Details
- Date
- Oct 28, 2022
- Kind
- Hack or exploit
- Method
- Contract Vulnerability
- How in
- Smart contract bug
- Target
- not stated
- Chains
- not stated
Reported by
Related incidents
OpenSea 2023 · Hack or exploit · undisclosed
OpenSea's stale listing issue burns another collector 2022 · Hack or exploit · $20K
OpenSea 2022 · Hack or exploit · $20K
Legal action begins against developer who solicited investments to build an OpenSea competitor, then used it to fund his NFT trading 2022 · Rug pull · $400K
SwanBluechip, "Opensea hack, Oct 28, 2022: undisclosed lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht77b3fba756/ (data as of 2026-10-31).