OAK — OnChain Attack Knowledge

Worked example · 2022-20

Social-Engineering Entry-Vector Cohort — 2022–2025

OAK Techniques observed
OAK-T3.005, OAK-T4.006, OAK-T15.006
Attribution
unattributed (aggregate cohort).
Loss
T3.005 aggregate undocumented at class level (per-campaign extractions typically in the hundreds-of-thousands to low millions, dispersed across victims); T4.006 ~$70K+ confirmed across the Google Play drainer campaign ($70K+, 150+ victims, per Check Point; the earlier-listed fake-MEV-bot multisig campaign figures of ~$480K are unverified and removed from this total); T15.006 ~$3M of NFT losses in the April 2022 BAYC Instagram account hijack (Yuga Labs figure), plus the Solana X-account compromise wave (no aggregate loss figure sourced here).
Corrected 2026-10-11
The ~$3M BAYC loss was from the Instagram hijack (not Discord moderator accounts), the DogWifCoin compromise was November 2024, and unsourced loss totals for the fake-MEV-bot campaign were removed.
Key teaching point
These three Techniques share a common structural feature — the attacker exploits a trust signal that the user reasonably relies on, but the trust signal is not cryptographically bound to the on-chain transaction the user ultimately signs. The staking frontend's domain (T3.005), the WalletConnect session's peer-dApp identity (T4.006), and the social platform's verification badge (T15.006) all serve as trust heuristics that the user's wallet cannot mechanically verify against the transaction payload.

Summary

Timeline

T3.005 from 2021–2022 (Lido stETH phishing campaigns); T4.006 systematic from 2023 onward (WalletConnect session-hijack phishing, mobile-app distribution campaigns at scale 2024); T15.006 systematic from 2022 onward (BAYC Discord/Instagram April 2022, Solana X-account wave November 2024–February 2025).

T3.005 — Fake-Validator Staking-Frontend Phishing

The attacker deploys a domain and UI that mirrors a legitimate liquid-staking protocol (Lido, Rocket Pool, Marinade). The user connects their wallet, approves a deposit transaction, and the deposited ETH/SOL is routed to an attacker-controlled address rather than the legitimate staking contract. The extraction primitive is the fake staking-interface deposit path — the user believes they hold stETH/rETH/mSOL but has sent funds directly to the attacker.

Sub-patterns:

  • Liquid-staking protocol impersonation. Domain typosquat (lido.fi → lido-stake.com; rocketpool.net → rocket-pool.org; marinade.finance → marinade-staking.com).
  • Validator-delegation portal impersonation. On Cosmos and delegation-model chains, the attacker impersonates a high-uptime validator.
  • Search-engine-advertisement interception. Purchasing search advertisements for staking-protocol keywords to place the fake frontend above the legitimate result.

The wallet-side deposit-destination verification (comparing the deposit target address against the canonical staking contract address) is the highest-leverage detection primitive.

T4.006 — WalletConnect Session Hijack

The victim is induced to establish a WalletConnect session with a malicious dApp (or software masquerading as a legitimate dApp), after which the attacker uses the session to solicit signing of malicious payloads. The entry vector is the session-establishment step.

Canonical cases:

  • Google Play drainer campaign — published March 2024, reported by Check Point 2024-09. Fake "WalletConnect" mobile apps distributed via Google Play under impersonating names ("Mestox Calculator", "WalletConnect — DeFi & NFTs", "WalletConnect — Airdrop Wallet"), achieving 10,000+ downloads and over $70K stolen across 150+ victims; Check Point reported the app first listed as "Mestox Calculator" and delivering MS Drainer. See examples/2024-09-walletconnect-google-play-drainer.md.
  • Browser and social-media WalletConnect phishing — 2023–2025. Drainer-as-a-service ecosystem (Inferno, Pink, Angel, Pussy, Monkey Drainers) commercialised T4.006 at industrial scale. See examples/2023-2025-walletconnect-phishing-campaigns-cohort.md.

T15.006 — Impersonation via Verified Social-Account Compromise

Compromise of a verified or officially-branded social media account (X gold/grey checkmark, Discord moderator/admin, Telegram channel admin) to distribute phishing links to the account's established follower base. The attacker exploits the platform's verification signal itself — the audience trusts the message because the platform's verification badge confirms the account's authenticity.

Canonical cases:

  • Solana ecosystem verified X-account compromise wave — 2025-02. Compromises of X accounts including Jupiter (2025-02-05) and Pump.fun (2025-02-26), which ZachXBT tied on-chain to the earlier DogWifCoin account compromise (November 2024). The compromised accounts promoted fake tokens. See examples/2025-02-solana-x-account-compromise-cohort.md.
  • BAYC Discord and Instagram compromises — 2022-04. On 2022-04-01 the official BAYC Discord was compromised (a fake "stealth mint" stole one Mutant Ape, per PeckShield via The Block); on 2022-04-25 the BAYC Instagram account was hijacked to post a fake Otherside land-mint link, with about $3M of NFTs stolen per Yuga Labs. The ~$3M figure belongs to the Instagram incident, and the earlier text's "2022-08" Discord moderator-role compromise is unverified. See examples/2022-04-bored-ape-discord-wave.md.
  • X verified-account phishing as a service — 2023–2025 (unverified in this pass). A liquid market for compromised verified X accounts emerged; attackers compromise verified accounts and sell access to phishing operators for single-campaign use.

The hardware-key MFA (FIDO2/WebAuthn) on every verified operator account is the highest-leverage mitigation — the dominant compromise vectors (SIM-swap, session-cookie theft) are both closed by hardware-key MFA.

Public references

Techniques demonstrated (3)