The Chief Information Security Officer (CISO) of SlowMist has reported that the 2022 data breach of the NFT marketplace OpenSea has now led to the full disclosure of the leaked information.
This breach incident that occurred in June 2022 is related to the email addresses of 7 million OpenSea users.
7 million OpenSea emails leaked... Cryptocurrency users at risk
On January 13, the Chief Information Security Officer (CISO) of blockchain security firm SlowMist said in a tweet that the leaked email addresses have now been fully disclosed.
"Remember the 2024 attack on the email service provider of OpenSea? The email addresses from that data breach incident, which had been circulating multiple times, have now been fully disclosed. Be wary of phishing emails and other potential cyber attacks," the SlowMist executive said.
According to the screenshot shared by the executive, the email of former Binance CEO CZ was also among the leaked data.
The initial breach in 2022 was caused by an employee of the email automation service Customer.io used by OpenSea, who reportedly abused their access to user data and shared it externally.
OpenSea had warned users at the time and advised them to be cautious of phishing threats.
While the breach incident occurred almost 3 years ago, the exposed data had not been publicly disclosed until recently. Now that over 7 million email addresses have been fully released, the likelihood of malicious actors launching phishing campaigns has significantly increased. Depending on the depth of the exposure, other personal information may also be included.
OpenSea has not yet directly addressed this recent incident. OpenSea users, especially notable holders, are now at a greater risk of becoming targets of scammers.
Moreover, cryptocurrency phishing attacks caused $500 million in losses in 2024, affecting over 330,000 addresses.
Hackers have also been attempting to hijack companies' X accounts to deceive users. Earlier this month, Litecoin reported unauthorized access to its official X account, with fraudulent content including fake tokens being posted.
SlowMist recommends vulnerable users to change their passwords and enable two-factor authentication on all their accounts.
