Moonbirds

Moonbirds creator Kevin Rose loses $1.1M+ in NFTs after 1 wrong move

Among the nonfungible tokens (NFTs) stolen from the PROOF co-founder were 25 Chromie Squiggles and one Autoglyph NFT.

Kevin Rose, the co-founder of the nonfungible token (NFT) collection Moonbirds, has fallen victim to a phishing scam leading to more than $1.1 million worth of his personal NFTs stolen.

The NFT creator and PROOF co-founder shared the news with his 1.6 million Twitter followers on Jan. 25, asking them to avoid buying any Squiggles NFTs until his team managed to get them flagged as stolen.

I was just hacked, stay tuned for details – please avoid buying any squiggles until we get them flagged (just lost 25) + a few other NFTs (an autoglyph) …

— KΞVIN R◎SE (,) (@kevinrose) January 25, 2023

“Thank you for all the kind, supportive words. Full debrief coming,” he then shared in a separate tweet about two hours later.

It is understood that Rose’s NFTs were drained after he approveda malicious signature that transferred a significant proportion of his NFT assets to the exploiter.

GM – what a day!
Today I was phished. Tomorrow we’ll cover all the details live, as a cautionary tail, on twitter spaces. Here is how it went down, technically: https://t.co/DgBKF8qVBK

— KΞVIN R◎SE (,) (@kevinrose) January 25, 2023

An independent analysis from Arkham found that the exploiter extracted at least one Autoglyph, which has a floor price of 345 ETH; 25 Art Blocks — also known as Chromie Squiggles — worth at least a total of 332.5 ETH; and nine OnChainMonkey items, worth at least 7.2 Ether.

In total, at least 684.7 ETH ($1.1 million) was extracted.

How Kevin Rose got exploited

While several independent on-chain analyses have been shared, Arran Schlosberg, the vice president of PROOF — the company behind Moonbirds — explained to his 9,500 Twitter followers that Rose “was phished into signing a malicious signature” that allowed the exploiter to transfer over a large number of tokens:

1/ This was a classic piece of social engineering, tricking KRO into a false sense of security. The technical aspect of the hack was limited to crafting signatures accepted by OpenSea’s marketplace contract.

— Arran (@divergencearran) January 25, 2023

Crypto analyst “foobar” further elaborated on the “technical aspect of the hack” in a separate post on Jan. 25, explaining that Rose approved a OpenSea marketplace contract to move all of his NFTs whenever Rose signed transactions.

He added that Rose was always “one malicious signature” away from an exploit:

be super careful when signing anything, even offchain signatures. kevin rose just had ~$2 million worth of NFTs drained from his vault from signing one malicious seaport bundle. thankfully a couple things held back, like the punk zombie (1000 ETH) which can’t be traded on OS pic.twitter.com/GXHR3NQHLf

— foobar (@0xfoobar) January 25, 2023

The crypto analyst said Rose should have instead been “siloing” his NFT assets in a separate wallet:

“Moving assets from your vault to a separate ‘selling’ wallet before listing on NFT marketplaces will prevent this.”

Another on-chain analyst, “Quit,” told his 71,400 Twitter followers that the malicious signature was enabled by the Seaport marketplace contract — the platform which powers OpenSea:

Kevin Rose was just lost $2m+ in assets by signing an off-chain signature that created a listing for all of his OpenSea approved assets in one go.

While seaport is a powerful tool, it can also be dangerous if you’re not aware of how it works.

A bit of context 1/

— quit (@0xQuit) January 25, 2023

Quit explained that the exploiters were able to set up a phishing site that was able to view the NFT assets held in Rose’s wallet.

The exploiter then set up an order to transfer to themself all of Rose’s assets that are approved on OpenSea.

Rose then validated the malicious transaction, noted Quit.

Meanwhile, foobar noted that most of the stolen assets were well above the floor price, which means that the amount stolen could be as high as $2 million.

Quit urged that OpenSea users “need to run away” from any other website that prompts users to sign something that looks suspicious.

NFTs on the move

On-chain analyst ZachXBT shared a transaction map to his 350,300 Twitter followers showing that the exploiter sent the assets to FixedFloat — a cryptocurrency exchange on the Bitcoin layer 2 Lightning Network.

The exploiter then swapped the funds into Bitcoin (BTC) and deposited the BTC into a Bitcoin mixer:

Three hours ago Kevin was phished for $1.4m+ worth of NFTs. Earlier today the same scammer stole 75 ETH from another victim.

Mapping this out we can see a clear trend of sending the stolen funds to FixedFloat and swapping for BTC before depositing to a bitcoin mixer. https://t.co/2yrFpfYttT pic.twitter.com/ZlywPYydwx

— ZachXBT (@zachxbt) January 25, 2023

Crypto Twitter member Degentraland told their 67,000 Twitter followers that it was the “saddest thing” they have seen in cryptocurrency space to date, adding that if anyone can come back from such a devastating exploit, “it’s him”:

Saddest thing I’ve seen in crypto to date.@kevinrose wallet drained.

If anyone can come back from this, it’s him. pic.twitter.com/HZysg34qji

— Degentraland (@Degentraland) January 25, 2023

Meanwhile, Bankless founder Ryan Sean Adams was enraged with the ease at which Rose was able to be exploited. In a Jan. 25 tweet, Adams urged front-end engineers to pick up their game and improve user experience (UX) to prevent such scams from taking place.

Bluechip NFT project Moonbirds signs with Hollywood talent agents UTA

PROOF Co-founder Kevin Rose announced the deal via Twitter on Jan. 6, noting that the aim is to get the Moonbirds brand recognized on a global scale and not just in the Web3 space.

The NFT-focused company was founded by early-stage Facebook and Twitter investor Kevin Rose, and designer Justin Mezzell in February 2022. The company also has the Proof Collective and Oddities NFT collections in its catalog.

Announcing the move via Twitter on Jan. 6, Rose suggested that the goal of the deal is to get the Moonbirds brand known on a “global” mainstream scale, as opposed to just being recognized as a big hitter in the Web3 space.

“What does UTA bring to the table? They are 1,400 people strong, with divisions in film, television, music, video games, sports, books, branding and licensing, speaking, marketing, fine arts, broadcast, and more,” he said.

PROOF, the company behind the top-tier NFT project Moonbirds, has signed a representation deal with major Hollywood talent agents United Talent Agency (UTA).

🙂

— Gary Vaynerchuk (@garyvee) January 6, 2023

Explaining the move a bit further, Rose noted that UTA will work on PROOF’s behalf to help “vet, broker, and execute partnerships and expansion opportunities across a variety of fields.”

The Ethereum-based Moonbirds project launched in April 2022 and consists of 10,000 8-bit owl-themed avatar NFTs. To date, it has generated roughly $619.5 million worth of secondary sales according to data from CryptoSlam.

That figure makes Moonbirds the eleventh highest-selling collection on the NFT market, with its nearest competitors being twelfth-placed Doodles at $553 million and tenth-placed CloneX at $794.9 million.

*Top 12 selling NFT projects of all time: CryptoSlam*

Despite the supposedly bullish UTA announcement, Moonbirds’ 24-hour sales volume has dropped a hefty 57.86%, with $442,747 worth of Moonbirds NFT changing hands during that time frame. Over a seven-day time frame however, trading volumes are still up by 63.74%.

The move from Moonbirds follows other big names in the NFT space to seek out Hollywood deals.

CryptoPunks founders Larva Labs were the first ones to pave the way back in September 2021, signing a deal with UTA to represent the firm’s IP across TV, film, video games, licensing and publishing.

The next month Yuga Labs — which now owns CryptoPunks — followed suit by signing up with UTA to push the Bored Ape Yacht Club IP into movies, TV, music and gaming. While the most recent occurrence before PROOF was the deal between UTA competitors WME and NFT start-up Boss Beauties.