Over $765K worth of NFTs stolen after SIM swap attack on GutterCatGang

July 8, 2023 Coin Telegraph

Over 5K worth of NFTs stolen after SIM swap attack on GutterCatGang

The bad actors utilized a fake GutterCatGang airdrop scam to drain people’s wallets, with at least $700,000 worth of NFTs being stolen from a single address.

More than $765,000 worth of nonfungible tokens has been stolen as part of a reported SIM swap attack on the GutterCatGang NFT project.

The security breach was highlighted by several NFT community members at around 8 pm UTC on July 7, with GutterCatGang co-founder @GutterMitch tweeting out a warning that: “Our Twitter has been compromised please do not interact with any links.”

Our Twitter has been compromised please do not interact with any links
— Gutter Mitch (@GutterMitch) July 7, 2023

Alongside the official GutterCatGang account, co-founder @gutterric was also hacked.

The hacker, or hackers used the accounts to share links to fake “limited edition” GutterCatGang NFT sneaker airdrops that essentially drained people’s hot wallets when they clicked on them.

In an effort to make the fictitious links look more legitimate, the tweets included recent GutterCatGang branding and imagery from the project's phygital sneaker drop in partnership with Puma and NBA/Charlotte Hornets star LaMelo Ball.

GutterCatGang Twitter account has been compromised please do not interact with it. #GutterCatGang @gutterdan_ @GutterCatGang —-> ⚠️⛔️ pic.twitter.com/tBu9fwBI7m
— Burden © (@0x_burden) July 7, 2023

Responding to Gutter Mitch’s thread, prominent blockchain sleuth ZachXBT asserted that the team was hacked via a SIM swap attack, as he questioned the team’s cyber security practices.

“Your team better look at a compensation plan for victims as it is gross negligence to have used SMS 2FA on your socials after all of the recent SIM swaps,” ZachXBT said.

In a separate thread, ZachXBT highlighted two victims of the attack, with one losing a Bored Ape Yacht Club NFT worth $65,913 at current floor prices, and another losing a whopping $700,000 worth of NFTs from a host of blue chip collections.

Someone else just lost $700k of assets (couple BAYCs, MAYC, Doodles, BAKCs, etc) pic.twitter.com/noNvkqkw9U
— ZachXBT (@zachxbt) July 7, 2023

Providing an update on the matter, GutterCatGang co-founder @gutterdan_ stated: “We are working with Twitter to regain access to the compromised Gutter-affiliated Twitter accounts.”

“We deeply sympathize with all those impacted and want to assure you that we are taking this matter very seriously and are working with law enforcement to investigate the hack and security breach,” he wrote.

We are working with Twitter to regain access to the compromised Gutter-affiliated Twitter accounts. We deeply sympathize with all those impacted and want to assure you that we are taking this matter very seriously and are working with law enforcement to investigate the hack and…
— Gutter Dan (@gutterdan_) July 7, 2023

At the time of writing, it appears that the accounts are still compromised.

GutterCatGang was launched in mid-2021 and consists of 3000 unique NFT cartoon cat avatars. The current floor price sits at 0.5 Ether (ETH), up almost 615% from the initial cost to mint, according to NFT Price Floor.

Magazine: NFT Collector: Snoop’s NFT nostalgia, The Goose draws Gen Y to Sotheby’s

AkuDreams dev team locks up $33M due to smart contract bug

April 25, 2022 Coin Telegraph

AkuDreams dev team locks up M due to smart contract bug

Aku

A highly anticipated NFT project has been hit with an exploit and a smart contract bug, causing a disruption to its auction and leaving the team with $33 million unable to be accessed.

The highly anticipated NFT project Akutars was marred by both an exploit and a bug on the weekend causing over 11,500 Ethereum (ETH) worth nearly $33 million to be locked forever within a smart contract, inaccessible even to the development team.

The exploit however, was conducted by someone trying to show a vulnerability in the project and not to steal funds via a hack.

The project went live on Friday April 22 with a Dutch Auction, a type of auction where the price lowers until it receives a bid, with the first bid winning the sale as long as the price is above reserve.

The auction opened at 3.5 Ethereum with only 5,495 of the available 15,000 NFTs up for sale and the smart contract set to refund any bidders who were underbid. Holders of an “Aku Mint Pass” were also given a 0.5 Ethereum discount on each minted NFT.

The $33M Bug

In a April 23 Twitter thread explaining the whopping $33 million bug, 0xInuarashi, a developer of multiple NFT projects explained Akutars' smart contract was coded so that refunds to bidders had to be processed first before the team could withdraw any funds.

The contract had a caveat that a minimum number of bids had to be made before it would allow for the team to withdraw, but the minimum number of bids was set to equal the amount of NFTs available for auction.

Unfortunately, due to some buyers minting multiple NFTs within the same bid, the terms of the contract mean it will never unlock, sealing away the nearly $33 million in Ethereum forever.

Cointelegraph contacted the Akutars team for comment but did not immediately hear back.

The exploit

In a now deleted tweet posted by the Akutars that was shared by DeFi developer foobar, it said that developers reached out to them warning that their contract could be exploited but appeared to shrug them off completely as they labelled the potential exploit a “feature”.

The AkuDreams team pretended that this was a feature, not an exploit, when multiple developers raised concerns prior to mint. Bizarre justifications. pic.twitter.com/cVgEXnnWzF
— foobar (@0xfoobar) April 23, 2022

During the mint an unknown individual executed what’s known as a “griefing contract” which locked the ability of the Akutars contract to process refunds to those underbid. The individual even embedded a message on the blockchain to the Akutars team saying they would stop the contract:

“Well, this was fun, had no intention of actually exploiting this lol. Otherwise I wouldn’t have used Coinbase. Once you guys publicly acknowledge that the exploit exists, I will remove the block immediately.”

Akutars then promptly responded by taking responsibility for the code and suggested that the exploit “was not done out of malice” and the person “intended to bring attention to best practices for highly visible projects.”

Quick Update (will go into more detail asap):

1. The exploit in the contract was not done out of malice; the person intended to bring attention to best practices for highly visible projects & novel mechanics. They unblocked the exploit quickly after we dug in and took ownership
— Aku :: Akutars (@AkuDreams) April 23, 2022

In a tweet on the same day, the project's founder and former pro-baseballer Micah Johnson offered an apology to the community, noting that after letting them down he will "continue to build brick by brick" and work tirelessly to avoid any similar issues moving forward.

The team also said that it will be issuing 0.5 Ethereum refunds to pass holders as well as airdropping the NFT to successful bidders.

The mistakes that were made are no more costly to anyone than myself. I’ve reinvested most everything into building Aku.

& most everything will go back to refunds and we will keep building what we set out to do.

Brick by brick. https://t.co/vQiPbl0Jpl
— Micah Johnson (@Micah_Johnson3) April 23, 2022

In an update posted on Sunday April 24 the team said it had rewritten its minting contract which was then audited by several developers and plans to mint on Monday April 25.

This article has been updated, with the headline changing from "$34M" to "$33M"