DeFiance Capital founder "Arthur_0x" has suffered an exploit of his hot wallet worth over $1.6 million in NFTs and cryptocurrency.

As Arthur states on his Twitter profile, it appears that he has been the victim of a socially engineered spear phishing e-mail attack. He downloaded a malicious PDF file that looked legitimate at first glance, however, upon opening the file, it infected his PC/Browser.

What is a Phishing attack?

💡
In short, phishing attacks are the practice of sending deceptive communications that appear to be from a legitimate source. It is usually done via e-mail. The aim is to steal sensitive data such as credit card and login information or to install malware on the victim's computer.

The Damage

Allegedly, Arthur lost 78 unique NFTs from five different collections, mostly "Azukis." Furthermore, he lost 68 wrapped Ether (wETH), 4,349 staked DYDX (stkDYDX) and 1,578 LooksRare (LOOKS) tokens.

The hacker began moving assets at about 12:30 am UTC, then promptly put all the NFTs up for bid on the OpenSea NFT marketplace. The hacker’s wallet held 545 ETH, worth about $1.6 million.

Unfortunately all NFTs have already been listed on Opensea and some of them have already been sold. OpenSea had already flagged a handful of the NFTs listed on the marketplace as “suspicious activity”.

He also believes that the "Lazarus Group" is behind this attack.

Who is Lazarus?

💡
The Lazarus Group (also known as Guardians of Peace or Whois Team) is a cybercrime organization with an unknown number of members. Although little is known about the Lazarus Group, experts have linked them to a number of cyberattacks between 2010 and 2021.

Arthur ended up posting "you mess with the wrong person". Let's see what will be his next steps to counter this incident.