OpenSea admits email addresses of users compromised due to a data breach

OpenSea, a leading non-fungible token (NFT) marketplace, has reported a data breach involving the emails of its customers. The breach occurred at OpenSea’s email delivery vendor Customer.io after one of its employees downloaded and shared the email addresses of users with an “unauthorised external party.” 

OpenSea didn’t specify how many users are likely to be impacted by this breach. However, it is said that users who have shared their email with OpenSea in the past, should assume they were impacted. OpenSea said that it has alerted law enforcement agencies about the breach and is helping Customer.io in its investigation. 

Regarded as the largest NFT trading platform in the world, OpenSea is believed to have been used by 1.8 million users to trade NFTs, as per DuneAnalytics, a blockchain analytics firm. It was valued at $13.3 billion in January after it raised $300 million in a Series C funding round led by Coatue and Paradigm. 

Given the platform’s user base, millions of emails could have been compromised. 

Further, OpenSea has warned users about phishing emails that will try to target them by impersonating OpenSea. It asked them to only trust emails sent from the domain: ‘opensea.io.’ 

“Because the data compromise included email addresses, there may be a heightened likelihood for email phishing attempts,” OpenSea said. 

It also cautioned users to not to click on any attachments or links or sign any wallet transaction after an email prompt. 

A few OpenSea users have reported an increase in spam emails in the company’s name. One user who goes by Metzilmazatl on Twitter wrote, “My info was breached thanks to OpenSea. I was wondering why I had so many spam texts, phone calls, and emails lately." 

This isn’t the first time the data of OpenSea users have been compromised. In February, OpenSea users were targeted by a phishing attack. The targeted users were sent a phishing email with hidden malware in the name of OpenSea. The attacker stole the NFTs of several users and sold them $1.7 million in ETH (crypto of Ethereum blockchain).