Financial News

Right-clicking and saving an NFT is still a popular — and incredibly simple — way of stealing somebody’s profile picture (PFP). And with no solution to this simple attack vector in sight, the world’s largest NFT marketplace, OpenSea has enacted a new, police-enforced theft policy.

The company is threatening legal action against crooks and will make centralized delisting decisions for problematic NFT collections. Ironically, it seems this decentralized industry built on distrust of government needs centralized policy-making enforced by police and the courts of government.

OpenSea posted the overhaul to its stolen item policy on Twitter, citing US law which forbids knowingly facilitating the sale or transfer of stolen items. It also says that it hopes the policy will deter burglars from stealing collections listed on its website.

The 13-tweet thread also threatened heightened police reporting and swifter responses to suspicious activity. Previously, the company only used police reports for escalated disputes but it will now use police reports for most theft reports.

To encourage identity verification, OpenSea will also simplify its Know-Your-Customer (KYC) system and, in addition, it’s escalating IP-, DNS-, and cookie-based fraud detection systems.

Victims of OpenSea theft want even more oversight and legal recourse

Even the new stolen items policy wouldn’t prevent all thefts, for example, the stealing of a number of Bored Ape Yacht Club NFTs that happened outside of OpenSea.

Indeed, Taiwanese pop star Jay Chou lost his Bored Ape to theft. Similarly, Seth Green paid a 165-ETH ransom to recover his Bored Ape.

Twitter users like Adam Hollander suggested even stricter policies from OpenSea, such as a waiting period to sell NFTs after they transfer between wallets. This would give victims more time to file a police report. Others suggested granting a longer grace period of six to eight weeks to produce a police report.

Skeptics also asked if OpenSea planned to make the changes retroactive. One user asked if a “suspicious” tag would be removed pending a police report. Another questioned whether OpenSea planned to leave reports made before the policy changes in limbo.

Others complained that OpenSea previously did not care about victims of theft or buyers who unwittingly bought stolen NFTs, while some commenters suspected that the company only made the changes due to pressure from thousands of NFT owners.

Still no defense from the most elementary attack

Even with its new overhaul, OpenSea’s stolen item policy still provides no defense against “right click and save” attacks. On many websites, someone could right-click and save an image, then immediately use that picture to mint a new NFT.

Some websites disable right-clicking on elements like images and links, but OpenSea doesn’t. Even if it did, it’s trivially easy to work around these website blockers.

Although blockchain developers can verify whether an NFT is genuine, a “right click and save” attacker could easily fool less technically savvy buyers. There are thousands of newcomers to the digital asset industry every day.

Read more: OpenSea has 99 problems — insider trading was just one

A recent MetaMask update will ask users to confirm a request for access to all NFTs in a certain collection. OpenSea called it an improvement that could make users more aware of what they are signing.

OpenSea’s past indifference toward theft and buyers who unwittingly bought a stolen NFT may justify the current skepticism about its new stolen item policy. The new policy could also fail to address the root of the NFT theft problem. Whatever the outcome, for almost two years, OpenSea has developed a poor reputation for keeping stolen NFTs from being dumped onto unsuspecting victims through its marketplace.

For more informed news, follow us on Twitter and Google News or listen to our investigative podcast Innovated: Blockchain City.

Crypto Wallet App Nufinetes Launches New Features Offering Users Access to Multiple Protocols.

American-based multi-blockchain wallet app Nufinetes has launched a new feature that allows users to interact with non-fungible tokens (NFTs) built on the Ethereum network. 

Nufinetes Rolls Out New NFT Features

According to a recent press release, the new upgrade offers its customers access to view and send Ethereum-based digital artworks from selected projects. 

The Nufinetes wallet app is already configured to support and view VIMworld’s SmartNFTs on the VeChain; however, the recent update expands its compatibility across the ERC-721 NFTs, all with an easy-to-use interface.

For clarity, Nufinetes is a multi-chain decentralized wallet designed to support the Ethereum blockchain, VeChain, and the BNB Smart Network allowing users to sign transactions across multiple chains using the designated Ethereum/BSC’s Wallet Connect or VeChainThor’s signing function. 

With this function, users can also interact with several decentralized exchanges (DEXs), including the popular UniSwap and PancakeSwap, and buy NFTs from different marketplaces. According to PR:

“Users now have the ability to sign transactions across multiple blockchains. Using Ethereum/BSC’s Wallet Connect or VeChainThor’s signing function, users can interact with dApps across all networks, freely sending transactions to a blockchain of choice.”

In addition to supporting Ethereum digital artworks, the new features have upgraded security to protect users from malicious actors. 

Through the upgrade, Nufinetes allows users to export their private keys directly to external storage for backup. 

The platform also rolled out a new FaceID for iOS users, offering an additional layer of security to mobile users. An “Always Ask” feature has been added to the wallet requiring the owners to use a pin code or biometrics to unlock their devices. 

The new feature also includes a Software Development Kit (SDK) for project teams and owners to integrate their projects into the Nufinetes application. 

The SDK is already available for VeChain users and will soon be deployed to the Ethereum blockchain. 

As the cryptocurrency industry grows larger, it has become abundant with scammers and thieves, with non-fungible tokens (NFTs) proving to be an increasingly attractive target, especially considering the sky-high prices that some of these tokens reach.

Predictably, being the biggest NFT marketplace, OpenSea has been the target of these thefts far too many times and tried to tackle the issue with relative success, forcing it to adjust its stolen digital asset policy which it detailed in a Twitter thread on August 11.

OpenSea’s existing policy

Currently, the marketplace’s policy penalizes any user buying a stolen NFT. The moment someone reports an NFT as stolen, it instantly gets banned from OpenSea until the person reports it being returned. 

Unfortunately, this means that an innocent person can be wrongfully punished for unknowingly buying a stolen NFT. The problem grows more complicated as malicious individuals start flagging as ‘suspicious’ the tokens that weren’t stolen in the first place.

Solution: Notify the police

Under the new policy, the marketplace requires a police report to be filed within seven days after the event, and only then will OpenSea disable the reported item for buying and selling.

If the marketplace doesn’t receive the police report within seven days, it will re-enable buying and selling of the reported NFT. According to the company:

“This change will help prevent false reports. We think this is a good 1st step & we’re grateful for the community’s suggestions.”

Furthermore, the updated rules make it easier for users who reported the theft to re-enable its buying and selling after recovery or decide to withdraw the report. As OpenSea explained:

“For example, we’re finalizing details on a simplified process that doesn’t require a notary.”

OpenSea’s troubles

It is worth noting that OpenSea was the platform on which scammers tried to use the Squiggles NFT project to defraud investors, as YouTube investigator Coffeezilla discovered in February. The marketplace responded by delisting the project.

In early May, news broke out that the OpenSea Discord channel had been hacked as a link was posted that led to a phishing site in partnership with YouTube. The marketplace’s support line had said it was investigating the situation, and that the channel was hidden from users.

Elsewhere, in March, Finbold reported that NFT trading volume on OpenSea was recording a decline in tandem with lower demand for NFTs, marking a 72% decrease from its high in January 2022. That said, the drop is likely the result of declining interest in NFTs as opposed to an increase in thefts.

Pastel Network recently announced establishing a partnership with Parity Technologies. The collaboration will see Pastel Network bringing permanent storage and NFT security to Polkadot.

As the builders behind Substrate and Polkadot, Parity Technologies is a well-known name in the industry. The partnership is a huge step for the entire NFT community, and it shows that the constant demand for verifiability, security, and reliability is being addressed with Pastel’s modern framework.

The collaboration means Polkadot will access Parity’s Web3 protocols, which can be easily integrated across Layer 1s and Layer 2s dApps. Parity will work with Polkadot’s L1 parachains and DeFi & NFT apps built on the network. 

This will allow the venture to integrate:-

• Sense, Near-Duplicate NFT Detection: It uses Deep Learning technology to assess the relative rareness of non-fungible tokens. It helps detect scams, copyright infringement, and counterfeits, providing certification of authenticity.
• Cascade, NFT Data, and Metadata Storage: It is a permanent, distributed redundant storage protocol. It prevents centralized points of error, 404 errors and IPFS pinning, and monthly subscription maintenance.

Since these protocols are lightweight with interoperability for Web3 Open APIs, Polkadot members can access them securely and distributedly.

In the long run, the platforms will collaborate to create trustless and decentralized interoperability using a communication bridge. Pastel Network can reach trustless communication with Polkadot using Substrate instance due to its non-parachain blockchain nature.

The Substrate instance can be deployed to the Polkadot network using a common-good community-operate or public utility parachain. In the beginning, Pastel’s network of SuperNodes (high-compute validators) can act as a federation of off-chain agents.

Such scale of interoperability allows Parity and Pastel to bring decentralized NFT security and permanence to the ecosystem. Given the platforms’ global success, their collaboration will render similar results.