0/ I explored the Kevin Rose hack using Once Upon (old account) and uncovered some more information about the hack, the hackers, and additional victims who were affected. Here’s a video explaining what happened (and a thread with screenshots below):

1/ Going into Kevin’s hacked account, we see the transaction that drained his NFTs occurred at 1:34pm ET. The transaction was executed from this account, labeled Hacker Account 1 (stay tuned, we’ll come back to this account later).

2/ In order for these NFTs to have moved from his account, Kevin would have had to give approval to OpenSea to move those assets (setApprovalForAll). The hack occurred at 1:34pm, and we can see that only 17 minutes before, Kevin begins giving access to OpenSea for multiple NFTs:

3/ Kevin mentioned doing this because he was listing a bunch of NFTs on OpenSea. He gives access to various NFTs up until 1:31pm, even successfully selling his OnChainMonkey in the process. The next transaction we see after Kevin’s final access approval is the exploit.

4/ When we look at the Net Asset Transfers in this transaction we can see exactly what was stolen, including the 0.590 WETH Kevin had just made on his OnChainMonkey sale 4 minutes earlier, because he had also approved OpenSea access to his WETH:

5/ It’s worth noting that Kevin’s Admit One was stolen, even though he hadn’t given access to that NFT recently. When we go to Kevin’s account page & filter for transactions including Admit One, we see it was stolen due to a transaction dating back to August 27th:

6/ Now, let’s dive into the hacker account we’ve labeled Hacker Account 1. Here the hacker executes the same exploit used on Kevin (marked by the matchOrders call) on multiple other victims, dating all the way back to January 3rd:

7/ How much was stolen in these exploits? Quite a lot… 75 WETH in one place, a @MattKaneArtist Gazers NFT (28.9 ETH floor) in another.

8/ We also see a few ENS permits made by the hacker, which becomes another interesting rabbit hole. It seems that in these instances, the victim is signing a message that then allows Hacker Account 1 to set a “spender” for the victim (who owns ENS tokens). Stay with me…

9/ One person affected by this exploit is @NatDotEth, who tweeted about the incident on January 10th:

10/ The account page for @NatDotEth (labeled ENS Hacked 1) shows she was hacked on January 9th via the exploit we found. It seems she signed a message that then allows Hacker Account 1 to execute a transaction that gives Hacker Account 3, a contract, access to her ENS tokens:

11/ The above screenshot shows permit being called, then the Hacker Account 3 smart contract transferring 403.290 ENS tokens to Hacker Account 2. This exploit was executed a few times, where numerous victims mistakenly gave access to their ENS tokens by signing a message.

12/ I feel terrible for @kevinrose and all the other victims of this hack. I’m hoping that these conversations around what happened (and why) will lead to features and products that provide more security for users going forward.

13/ Huge thank you to @gaby_goldberg who played a major role in this investigation.

@kevinrose @onceupongg Great thread and what unfortunate timing from KRO to approve those 17 minutes before the malicious signature

@backseats_eth @kevinrose @onceupongg great thread detailing everything