OpenSea Phishing Incident Analysis

In February 2022, a targeted phishing campaign impersonating OpenSea tricked users into approving a malicious contract (an "ice phishing" attack), enabling the attacker to transfer NFTs from 28 wallets—including high-value BAYC and Mutant Ape assets—resulting in roughly $2M in stolen NFTs and 1105 ETH laundered through Tornado Cash; the report also warns of subsequent phishing attempts enabled by an email data leak and emphasizes distinguishing approval-based theft from classic credential/seed-phrase phishing.