NFTs: The growing cybercrime risks and how to avoid them

One lesser-known aspect of non-fungible tokens is their vulnerability to cybercrime. Learn how you can protect yourself and your company from the potential risks of NFTs.

Non-fungible tokens (NFT) are a trendy topic in the blockchain world, but they’ve reached a wider audience and are gaining popularity with individuals and corporations, too. Unfortunately, NFTs are a tempting target for cybercriminals. How can attackers benefit from NFTs and what measures can you take to avoid becoming a victim? Read on to find out.

What are NFTs?

Non-fungible tokens are data existing in a blockchain that can be sold or traded. This data can be associated to photos, videos, documents or any other kind of file you might think of.

Each NFT is unique, and one of the main reasons for owning it is that it guarantees the authenticity and uniqueness of the file it relates to. In other words, a proof of ownership. NFTs can be bought or traded on various dedicated marketplaces.

While it might sound like an incredible opportunity to be able to sell a GIF file for hundreds of dollars, “minting” (the word used for creating an NFT in the blockchain) NFTs can involve a significant cost — although that can vary depending on the blockchain used. Also, there may be misconceptions amongst those buying NFTs. A lot of people think they are purchasing the asset itself rather than just the token.

SEE: NFTs cheat sheet: Everything you need to know about non-fungible tokens (free PDF) (TechRepublic)

NFTs for business purposes

Companies have started using NFTs for several reasons, in addition to their being “the thing to have” in recent months. Some companies associate NFTs and physical goods. It is possible to sell a real item together with its token, as, for example, Nike has done with sneakers.

NFTs can also be sold by companies to virtual audiences. For instance, clothing companies might create virtual items and sell them in virtual world markets. And NFT creators can benefit from future item sales, as companies can ask for a percentage of future profits and program the functionality into the NFT.

NFTs may help in the fight against counterfeit products, as well. An NFT minted by a company and provided when selling the product guarantees it comes from them and is not a counterfeit.

Finally, supply chain management can make good use of NFTs, as product traceability and origin are a popular use case of blockchain technology.

NFT and cybercrime

Considering the amount of money that has been and is currently being injected into NFTs, it is inevitable that cybercriminals are seeking new ways to make easy money with them.

Fake NFT selling

One of the first ideas occurring to fraudsters with a low knowledge of computers involves taking any item that is not theirs on the internet (e.g., a video or a picture) and selling it on marketplaces by making people believe it is legit.

Account takeover

In March 2021, NFT marketplace Nifty Gateway reported such action against some of their users. Victims claimed they either had their NFT art stolen or NFTs purchased and then stolen using their credit card information. The NFTs were then sold again. These users learned a lesson the hard way: It wouldn’t have happened if they’d activated 2-factor authentication (2FA) on their account.

Private key theft

Like any other cryptographic coin or token, an NFT is controlled by a private key. Depending on the services the NFT owner uses, they might store this private key themselves, or have it stored by an online marketplace they use. In both cases, that private key might be stolen if an attacker manages to compromise the system that stores it. Malware that steals Bitcoin wallets has been around for some time already, as has malware that steals NFTs.

Fake marketplaces

It’s possible for cybercriminals to fully create a website from scratch, put fake NFTs on it, pretend to be a new legitimate marketplace, and hope people will come and buy. Yet the most common scheme consists of building fake websites that are visually an exact copy of a legitimate one (Figure A) and use social engineering methods to bring people to it.

Figure A

Users might be guided to the fake website by email impersonating the legitimate marketplace or be approached on applications like Discord, where it is easy to find NFT-related channels and people. Cybercriminals might also compromise legitimate accounts from the marketplaces and use it to spread links to their fake websites. This has been done against the Fractal NFT marketplace, for example, whose official Discord bot got compromised and started sending a fake link to more than 100,000 users (Figure B).

Figure B

Malware

Trojan malware can easily steal data from compromised computers. This may include private keys to NFTs or wallets. Users might get compromised by such malware via phishing campaigns or malicious websites, or through direct messaging in specialized channels.

Recently, security company Morphisec exposed the case of a malware purposed for data theft, which was spread via Discord bots. Those bots were sending private messages to Discord users, pretending to be coming from legitimate NFT communities. The messages invited the users to download a new application from an official-looking website set up by the attackers. The victims, clicking on the link and downloading the malware from what seemed to be a legitimate website, could not tell that something was going wrong. Once the victims were compromised, the attackers could steal data and grab any wallet or private key.

SEE: Quick glossary: Blockchain (TechRepublic Premium)

How can a user or a company safely use NFTs?

There are measures you can take to help protect yourself and your organization, including the following security steps:

• Always activate 2-factor authentication (2FA) to access NFT marketplaces.
• If possible, use a hardware wallet rather than just storing your wallet on your computer or phone.
• If your wallet is stored on your computer or phone, have it stored encrypted, with the passphrase not being written in any file.
• Do a background check on who you are buying NFTs from. If the user has no reputation or trace on social networks, you might want to reconsider buying from them.
• Double-check any email or message you get from a supposed legitimate marketplace or its administrator. If there is a link to click, do not click it — go straight to the website without using the link, and find the related information. You might also have the link analyzed first by your IT department to be sure it is not leading to a fake website or a malware.
• The usual computer security recommendations are still helping: Always have all your software up to date, your systems and servers patched, and have security solutions in place to detect malware and fake URLs.

Disclosure: I work for Trend Micro, but the views expressed in this article are mine.