你的NFT还安全吗？OpenSea“钓鱼攻击”事件又给我们哪些启示？

成都链安2022-02-24 tarihinde yayınlandı2022-03-03 tarihinde güncellendi

Özet

黑客虎视眈眈，用户资产频繁被盗，这都凸显了这个尚未受到监管的NFT交易市场的风险所在。在安全之路上，NFT要走的道路还很远。

2月20日，成都链安链必应-区块链安全态势感知平台舆情监测显示，全球最大的加密数字藏品市场 OpenSea 遭遇了黑客攻击。
根据OpenSea官方的回复，本次事件由黑客趁着 OpenSea 合约升级之时，给所有用户的邮箱发送了一封钓鱼邮件，而不少用户错把其当作官方邮件而将自己的钱包授权，进而导致钱包被盗，目前OpenSea 已经排除了合约迁移工具是攻击载体的可能性。 OpenSea 的联合创始人兼首席执行官 Devin Finzer 发推说攻击者窃取了价值 170 万美元的以太币。

「钓鱼攻击」，在互联网世界摸爬滚打的你肯定不陌生，在区块链领域里，这种古老的攻击的方式仍然存在，并蔓延到了NFT资产领域。你的NFT还安全吗？OpenSea“钓鱼攻击”事件又给我们哪些启示？

1 NFT资产被盗事件为何仍有发生
先是去年3月17日，NFT交易市场Nifty Gateway的数名用户遭遇了账号被盗，有受害者称，黑客从其帐户中窃取了价值数千美元的数字艺术品；其他被黑客入侵的用户称，他们存档的信用卡被用来购买额外的NFT。
而在今年1月10日，纽约艺术品藏家兼画廊主托德·克拉默（Todd Kramer）曾发文寻求帮助，他有超过220万美元的NFT艺术品被盗，引发关注。随后，NFT交易平台OpenSea通过阻止对该系列作品的进一步交易来施加干预。
接着2月1日，一位NFT收藏大户larrylawliet.eth在社交媒体表示，其持有的多只无聊猿猴游艇俱乐部（Bored Ape Yacht Club）、变异猿猴游艇俱乐部（Mutant Ape Yacht Club）以及Doodles NFT等系列价值不菲的NFT藏品被黑客盗取。该收藏大户表示，造成本次失窃的直接原因是自己钱包的隐私信息泄漏。
可见随着部分NFT的收藏价值越来越高，黑客也开始觊觎用户的钱包，将用户的NFT洗劫一空，这也是NFT资产被盗事件时常发生的原因。

2 你的NFT够安全吗？
当谈到 NFT 智能合约本身的安全性时，事实证明它们能够更好地抵御攻击，因为NFT 智能合约通常比可替代代币的智能合约包含更简单的代码。此外，NFT 生态系统不像 DeFi 那样复杂，这也将黑客威胁降至最低。
目前NFT的风险可大致分为两类：
一是NFT本身的授权问题(NFT持有者可授权其它地址作为代理人)，可能因NFT持有者的误操作，导致NFT权限被劫持(主要是钓鱼网站、钱包层面的不安全接口调用)；
二是NFT参与DEFI系统后引入的外部风险，如：NFT质押挖矿合约本身所带来的安全风险，这部分与常规DEFI风险基本一致。

3 如何保护自己的NFT？

NFT这波热潮吸引了无数人，当然，除了警惕NFT炒作之外，还需要防范各类NFT骗局套路，最近一年与NFT有关的诈骗数量和范围也呈现出现爆炸性增长，大家还需要多加防范。小心钓鱼陷阱、过度包装诈骗、社交媒体诈骗、赠品/空投骗局等等。

1、钓鱼陷阱/伪造NFT平台
骗子复制当红NFT零售网站，这些网站看起来与原始网站完全一样，这类网站会获取用户的账号和银行卡信息，进而形成诈骗。当然，还有一些所谓的NFT商店，就是一个空壳，他们在商店中向用户出售根本不存在的产品。

2、假冒艺术家发售NFT骗局
有些项目方因为没有得到艺术家或者明星的授权，比如名画或者歌曲，他们就假冒艺术家，伪造假的NFT，用户需要谨慎购买或出价，因为没有授权的NFT，其实也没有收藏价值，是不被认可的。

3、社交媒体骗局
诈骗分子在加密社区或者社交媒体推特、Telegram、微信群、QQ群等实施诈骗行为，比如他们会假扮客服，或者通过回答你的问题来获取信任，最后再来套路你。

4、赠品/空投骗局
虚假NFT就是冒牌，假限量真增发。由于NFT的内容载体是公开的，伪造基本是没有成本的，导致造假者不断。此外，骗子们大范围免费空投NFT，诱骗数字钱包授权或私钥，趁机窃取用户资产。

4 写在最后
黑客虎视眈眈，用户资产频繁被盗，这都凸显了这个尚未受到监管的NFT交易市场的风险所在。在安全之路上，NFT要走的道路还很远。

İlgili Okumalar

Claude Doesn't Submit Code Directly After Writing It: Runs 4 Skills for Self-Check, Fixes Issues, Then Comes Back to You

Claude No Longer Submits Code Directly: 4 Self-Check Skills to Run Before Coming Back to You AI already writes code, but the burden of reviewing it still falls on you. To address this, Anthropic has built a "verification loop" into Claude Code. After writing code, Claude now runs four self-check skills before delivering the work: * `/code-review`: Finds potential bugs and provides review feedback. * `/simplify`: Cleans up the diff, removing redundant or over-complex implementations to reduce future maintenance costs. * `/verify`: Performs end-to-end validation, actually running the application to confirm the feature works, not just appears to. * `/design`: Used only for UI changes; cross-references the implementation against the project's DESIGN.md file. This loop extends the AI agent's workflow from "gather context → execute" to "gather context → execute → auto-verify → fix → re-verify." It tackles the new bottleneck in AI-assisted development: the speed of verifying code now outpaces human review. These skills are built on Claude Code's existing verification foundation (like running apps and using linters). Teams can create their own custom verification skills by documenting their repetitive manual checks in plain language as Markdown files. Verification can be triggered at four levels: manually (Standalone), embedded in a task, chained with other skills, or automatically on every PR (On every PR). The shift signifies that competition in AI programming is moving from code generation to robust verification and self-correction. Well-built verification loops allow AI agents to run longer and more autonomously with less human supervision. Skills, which encapsulate team knowledge and workflows, are becoming a cross-vendor standard, meaning a team's efficiency gap will depend less on the AI model and more on their investment in these automated workflows and verification mechanisms.

marsbit4 dk önce

Claude Doesn't Submit Code Directly After Writing It: Runs 4 Skills for Self-Check, Fixes Issues, Then Comes Back to You

marsbit4 dk önce

How Has Beijing Become a 'Global High Ground'?

How did Beijing become a "global highland"? In the first half of the year, Beijing's GDP grew by 5.4%, with growth in Q1 reaching 5.9%. Key drivers were not consumption or real estate, but hardcore sectors like chips, robotics, computing power, and large AI models. Investment concentrated sharply in tech, with high-tech manufacturing investment up 36% and technology services investment up 87.2%. Nearly 90% of venture capital flowed into hard tech. Output figures were strong: integrated circuit production rose 17.8%, industrial robots 75.5%, and service robots surged 230%. Companies like Qianxun AI and Galaxy General Robotics are deploying robots in real-world logistics and manufacturing, moving beyond demonstrations. The services sector is also being reshaped by tech, with software, IT, and finance growing faster than the sector average. Beijing leads in AI and embodied intelligence. Galaxy General Robotics secured significant funding, including from state-backed funds. The city released foundational AI models and its independent AI ecosystem, FlagOS, is expanding. Companies like Jiuzhang Yunjie provide neutral computing power and base models, supporting the broader ecosystem. Infrastructure is expanding, with Beijing aiming to add over 70,000 Petaflops of intelligent computing power annually. A "Beijing R&D, surrounding training" model is emerging, with computing resources being allocated to regions like Hebei and Tianjin. Efforts to deepen integration within the Beijing-Tianjin-Hebei region include industrial relocation and improved transport links. To bridge the gap between lab and market, Beijing is establishing pilot-scale production platforms. The underlying trend is the convergence of computing power, capital, talent, and real-world applications. While challenges remain in commercialization and regional integration, Beijing's focus on strengthening these interconnected elements is building the foundation for its claim as a global innovation hub.

marsbit5 dk önce

How Has Beijing Become a 'Global High Ground'?

marsbit5 dk önce

How Did the Target Price of 116 Yuan and a Market Cap of 7.9 Trillion for CXMT Come About?

Nomura's inaugural coverage report on ChangXin Memory Technologies (CXMT) gives a 'Buy' rating with a highly aggressive target price of 116 RMB, implying a 1239.5% upside from the IPO price of 8.66 RMB. The valuation is derived by applying a 20x P/E multiple to projected 2028 EPS of 5.79 RMB. The 20x multiple combines Micron's historical valuation with a premium for Chinese A-shares. The report's financial forecasts are exceptionally bullish. It projects revenue to soar from 62B RMB in 2025 to 773B RMB in 2028, with net profit surging to 393B RMB. A key, and arguably unsustainable, assumption is gross margin expanding to over 90% by 2028, driven almost entirely by price increases with minimal cost growth. This optimism is rooted in a forecast that global DRAM demand will grow over 7x from 2026 to 2030 (CAGR >60%), fueled by agentic AI. Nomura argues that supply growth (30-40% CAGR) will lag far behind demand, creating a persistent shortage. Bottlenecks in cleanroom space, equipment, materials, and skilled engineers will constrain rapid industry expansion. For CXMT, Nomura expects capacity to reach 550k wafers/month by 2028. The company's bit output is forecast to grow 40-45% annually, allowing its global market share to rise from ~10% to ~18%. While CXMT's technology lags leaders by about five years, limiting its wafer ASP, it benefits from supportive domestic procurement policies. Key risks include the cyclicality of memory pricing, with the 90% margin assumption representing a peak-cycle scenario rather than a sustainable norm.

链捕手14 dk önce

How Did the Target Price of 116 Yuan and a Market Cap of 7.9 Trillion for CXMT Come About?

链捕手14 dk önce

What Will Ethereum Look Like in 2030?

**Title: What Will Ethereum Look Like in 2030?** **Summary:** This article outlines the "Lean Ethereum" vision, a unified roadmap for Ethereum's evolution leading up to 2030, centered around five key "North Star" goals: 1. **Fast L1:** The goal is to reduce transaction finality from ~15 minutes to seconds and block times from 12 seconds to 4 seconds. This will be achieved through a streamlined consensus mechanism using zero-knowledge proofs (ZK proofs) to aggregate validator votes efficiently. The minimum staking requirement will also be lowered to 1 ETH, promoting greater decentralization. 2. **Billion-Gas L1:** Ethereum aims to increase its Layer 1 throughput by ~200x, targeting 1 billion gas per second. The breakthrough relies on implementing an L1 ZK-EVM, where a single cryptographic proof verifies all transactions in a block, eliminating the need for every node to re-execute them. This enables massive scalability while allowing even light clients (like phones) to fully verify the chain. 3. **Trillion-Gas L2:** The focus shifts to scaling Layer 2 networks (Rollups). Enhancements like PeerDAS and planned upgrades will expand data bandwidth (blob capacity) to 1GB per second, supporting a vast ecosystem of high-throughput L2s. Ethereum will solidify its role as a secure settlement layer, with specialized L2s (e.g., for tokenized stocks) handling application-specific logic. 4. **Quantum-Resistant L1:** To counter future quantum computing threats, Ethereum plans to transition its cryptographic signature schemes (ECDSA, BLS) to quantum-safe, hash-based alternatives. A dedicated post-quantum research team is working on this transition, slated for completion around 2029. 5. **Privacy-Native L1:** For the first time, native privacy is an official goal. Using ZK proofs, transactions could hide sender, receiver, and amount details while proving compliance with network rules. This addresses critical privacy concerns for both individuals and enterprises, though regulatory uncertainty remains. The article notes that development is becoming more decentralized, with new institutions like Ethlabs emerging alongside a downsized Ethereum Foundation. While the "Strawmap" document guiding this vision is a living draft subject to change and delays, the core ambition is clear: to make Ethereum faster, more scalable, quantum-secure, and privacy-preserving while retaining its foundational properties of neutrality and trustlessness.

Foresight News16 dk önce

A Critical Week Begins for Bitcoin and Altcoins: All Eyes on the Fed's Interest Rate Decision! When Will It Be Announced? What Message Will the Chairman Send...

This week is critical for Bitcoin and altcoins, as all eyes turn to the Federal Reserve's (Fed) July interest rate decision. The Fed is set to announce its decision on Wednesday, July 29th, at 21:00 Turkey Time (GMT+3). Following the announcement, new Fed Chair Kevin Warsh will hold a press conference at 21:30. Markets currently expect the Fed to hold interest rates steady in July, with probabilities at 66.3% for no change and 33.7% for a 25-basis-point hike. This follows the Fed's decision in June to leave rates unchanged at 5.25-5.50%. Many experts anticipate the Fed will not raise rates for the rest of the year, citing limited inflationary impact from recent tariffs. Bitcoin, having surpassed $65,000 again, and global markets started the week positively after the de-escalation of U.S.-Iran tensions. However, investors will closely monitor the Fed's statement and Chair Warsh's comments for clues on future policy. Chief Economist Mark Zandi of Moody's Analytics stated he expects rates to remain unchanged this year and next, noting inflation has likely peaked. A significant source of uncertainty is the new Fed Chair, Kevin Warsh. Analysts note Warsh maintains a more opaque and less communicative style than his predecessor, Jerome Powell, preferring brief answers and offering fewer forward-looking signals. This shift in communication style makes policy predictions more difficult and could lead to increased bond yield volatility as markets parse his words for hints.

cryptonews.ru19 dk önce

A Critical Week Begins for Bitcoin and Altcoins: All Eyes on the Fed's Interest Rate Decision! When Will It Be Announced? What Message Will the Chairman Send...

cryptonews.ru19 dk önce

İşlemler

Spot