Worked example · 2025-06

Pepe Creator (Matt Furie) NFT contract hijack via fake-IT-worker social engineering — Ethereum — 2025-06-18 to 2025-06-25

Loss: approximately $1 million in extracted NFT sale proceeds across five collections. ~$310,000 from ChainSaw-incubated projects Replicandy and Peplicator (contract ownership transferred June 18, 2025). >$680,000 from Favrr (contract compromised June 25, 2025). Hedz and Zogz contracts also compromised in the same window on June 23. Floor prices across affected collections crashed to near-zero after the unauthorized mint-and-sell operation.
OAK Techniques observed: OAK-T15.001 (Social Engineering of Operator Personnel — primary entry vector; the attacker posed as a legitimate IT worker/developer, passed a hiring process, and was granted smart-contract ownership or administrative access as part of the developer role) + OAK-T9.004 (Access-Control Misconfiguration — the smart-contract ownership model allowed a single EOA to control mint functions without timelock or multisig; once the fake IT worker's EOA held ownership, the mint-and-sell extraction was unconstrained) + OAK-T12.002 (Fake-Mint/Counterfeit Collection — adjacent; the attacker produced unauthorized NFTs under the genuine collection contract using the hijacked mint function, functionally equivalent to a counterfeit mint from the buyer's perspective: the buyer purchased an NFT that was economically unauthorized, produced by an attacker-controlled wallet using the genuine contract's mint function rather than a counterfeit contract) + OAK-T12 broadly construed — the extraction surface was NFT-collection contract ownership hijack, a structural NFT-specific pattern that sits between T12.002 (the genuine contract produced unauthorized mints equivalent to counterfeits) and a proposed T12.x sub-technique for genuine-contract hijack with unauthorized mint + OAK-T7.001 (Mixer-Routed Hop — partial; funds from ChainSaw projects moved through three intermediary wallets before reaching MEXC and Gate.io deposit addresses).
Attribution: pseudonymous — ZachXBT attributed the operation to North Korean (DPRK) IT workers based on: GitHub accounts with Korean language settings, Astral VPN usage, Asia/Russia timezone activity patterns, and repeated stablecoin transfers ($2,000–$10,000 range over several months) to a MEXC deposit address consistent with a broader IT-worker network. The Favrr developer "Alex Hong" deleted his LinkedIn profile after the incident; past work history could not be verified. No named-individual attribution at v0.1.
Key teaching point: The Pepe NFT contract hijack is the canonical 2025 anchor for the fake-IT-worker-as-NFT-contract-hijack-entry-vector sub-pattern. The attacker did not exploit a smart-contract bug, compromise a private key, or phish a signing surface — they passed a hiring process, gained legitimate administrative access to NFT smart contracts as a "developer," then used the contract's own mint function to generate and sell NFTs. The structural lesson is that NFT project teams that grant sole-EOA contract ownership to developers without timelock or multisig are T15.001-exposed by construction — the hiring process is the access-control surface, and the contract's ownership model is the blast-radius amplifier.

Summary

In June 2025, at least two North Korean IT workers (per ZachXBT's on-chain attribution) were hired as developers by NFT projects associated with Matt Furie, the creator of the Pepe the Frog character. The projects — Replicandy, Peplicator (both under the ChainSaw incubator), Hedz, Zogz, and Favrr — granted the "developers" smart-contract ownership or administrative access as part of their developer role.

On June 18, 2025, the Replicandy contract's ownership was transferred to an attacker EOA. The attacker used the contract's mint function to generate new NFTs and immediately sold them into existing collection bids, extracting approximately $310,000 from Replicandy and Peplicator combined. On June 23, the same address (or a linked address) seized control of Hedz and Zogz contracts using the same method. On June 25, the Favrr contract was compromised, with over $680,000 extracted through unauthorized mint-and-sell operations.

The unauthorized mints crashed floor prices across all affected collections to near-zero. The funds from ChainSaw projects were routed through three intermediary wallets, with portions converted to stablecoins and sent to deposit addresses at MEXC and Gate.io. ZachXBT's investigation identified GitHub accounts linked to the attackers with Korean language settings, Astral VPN usage, and activity patterns consistent with the Asia/Russia timezone — the canonical DPRK IT-worker fingerprint.

The case is the first publicly-documented instance of the DPRK IT-worker infrastructure being used specifically to hijack NFT-collection smart contracts. Prior DPRK IT-worker cases targeted cryptocurrency exchanges, DeFi protocols, and wallet-software supply chains; the Pepe NFT case extends the known target set to include NFT-collection projects with sole-EOA contract ownership models.

Timeline (UTC)

When	Event	OAK ref
Pre-June 2025	At least two DPRK IT workers hired as developers by Matt Furie-affiliated NFT projects (ChainSaw/Replicandy/Peplicator, Favrr); granted contract ownership or administrative access	T15.001 (social-engineering entry — fake-developer hiring)
2025-06-18	Replicandy contract ownership transferred to attacker EOA; unauthorized mint-and-sell begins; ~$310K extracted from Replicandy + Peplicator	T9.004 (sole-EOA ownership model); T12 (NFT extraction surface)
2025-06-23	Hedz and Zogz contracts compromised by same/linked attacker address	T9.004 (ownership seizure)
2025-06-25	Favrr contract compromised; >$680K extracted via unauthorized mint-and-sell; floor prices crash to near-zero	T12 (extraction peak)
2025-06-25 onward	ZachXBT publishes on-chain attribution thread linking the operation to DPRK IT workers; Matt Furie and ChainSaw delete community warning without explanation	T15.001 (attribution)
2025-06 onward	Funds routed through MEXC and Gate.io deposit addresses; most ChainSaw exploit funds remain unmoved at v0.1 cutoff	T7.001 (laundering tail)

What defenders observed

Pre-event (hiring-process gap): The DPRK IT workers passed hiring processes at multiple NFT projects. Basic due diligence — verification of past work history, LinkedIn profile consistency, GitHub activity timeline, and timezone/linguistic fingerprinting — was not performed or was insufficient. The Favrr developer "Alex Hong" had a LinkedIn profile that was deleted after the incident and past work that could not be verified.
At-event (contract ownership transfer): The load-bearing on-chain signal was the transferOwnership (or equivalent) call on each NFT contract, transferring control to an EOA with no prior funder-graph connection to the project's deployer cluster. The ownership transfer was the access-acquisition primitive; the subsequent mint-and-sell was the extraction primitive.
At-event (unauthorized mint-and-sell): The attacker used the contract's own mint function — the mints were technically "authorized" by the contract (the caller was the owner) but economically unauthorized by the project. The mint-and-sell pattern was structurally identical to a legitimate mint from the contract's perspective, making it invisible to standard mint-function access-control checks.
Post-event (attribution fingerprint): ZachXBT's attribution used the canonical DPRK IT-worker fingerprint: GitHub accounts with Korean language settings, Astral VPN usage, Asia/Russia timezone activity, repeated small-value stablecoin transfers to MEXC deposit addresses over months (consistent with salary/wage payments to an IT-worker network). The MEXC deposit address was the load-bearing attribution anchor.

What this example tells contributors writing future Technique pages

The Pepe NFT case extends the DPRK IT-worker target set to include NFT-collection projects. Prior documented DPRK IT-worker infiltration cases targeted cryptocurrency exchanges (Coinbase 2024, per ZachXBT), DeFi protocols (multiple 2024-2025 cases), and wallet-software supply chains. The Pepe case demonstrates that NFT projects with sole-EOA contract ownership are attractive targets because the extraction surface (unauthorized mint → sell into bids) is simpler than the multi-step extraction required for DeFi protocol compromise.
Sole-EOA contract ownership is the load-bearing structural defect for NFT projects. Every affected project had a contract ownership model where a single EOA held mint authority without timelock or multisig. A multisig ownership model or a timelocked mint function would have required the attacker to compromise multiple signing keys or wait through a delay window — either of which would have provided a defender-observation window. Future T12 technique pages should flag sole-EOA ownership as a standing risk factor for NFT-collection contracts.
The Pepe case is structurally adjacent to T12.002 but the extraction surface is the genuine contract, not a counterfeit one. T12.002 covers counterfeit collections deployed by the attacker. The Pepe case is the mirror image: the attacker hijacks the genuine collection's contract and uses its mint function to produce NFTs that are technically authentic (signed by the canonical contract) but economically unauthorized. The buyer-side harm is identical — the victim purchases an NFT believing it is a legitimate collection item — but the attacker does not need to deploy a counterfeit contract or route victims to a phishing mint page. Future T12 technique pages should consider a sub-technique for genuine-contract hijack with unauthorized mint as a sibling to T12.002's counterfeit-contract pattern.

Public references

[zachxbtpepenft2025] — ZachXBT, X thread on Pepe creator NFT contract hijack and DPRK IT-worker attribution (2025-06).
[cryptoslatepepenft2025] — CryptoSlate, "Pepe NFT Creator's Projects Drained of $1M in Contract Hijacking Heist" (2025-06).
[benzingapepenft2025] — Benzinga, "Pepe Creator Projects Hit by $1M Exploit Linked to North Korea IT Workers: ZachXBT" (2025-06).
[coincupepenft2025] — CoinCu, "Hackers Exploit Matt Furie's NFT Projects with Over $1 Million Loss" (2025-06).

Citations

[zachxbtpepenft2025] — primary on-chain attribution; MEXC deposit address, GitHub fingerprinting, DPRK IT-worker cluster identification, wallet routing analysis.
[benzingapepenft2025] — contemporaneous reporting; per-project loss breakdown (~$310K ChainSaw, >$680K Favrr), contract ownership transfer mechanism, "Alex Hong" deletion of LinkedIn.

Discussion

The Pepe Creator NFT contract hijack is the canonical 2025 anchor for the fake-IT-worker-as-NFT-contract-hijack-entry-vector sub-pattern. The case demonstrates the recurring structural property that NFT project teams that hire developers without basic due diligence and grant sole-EOA contract ownership are T15.001-exposed by construction. The attacker did not exploit a smart-contract vulnerability, compromise a private key, or execute a phishing campaign — they passed a hiring process, were granted legitimate administrative access, and used the contract's own functions to extract value.

The case is structurally the first publicly-documented instance of the DPRK IT-worker infrastructure targeting NFT-collection projects specifically. Prior DPRK IT-worker cases (documented across the 2024-2025 window per ZachXBT, TRM Labs, and Chainalysis) targeted DeFi protocols, cryptocurrency exchanges, and wallet-software supply chains. The Pepe case extends the known target set and demonstrates that the extraction surface for NFT projects is simpler than for DeFi protocols: once contract ownership is obtained, the attacker mints NFTs and sells into existing bids, requiring no multi-step DeFi protocol interaction.

The attribution surface is stronger than typical pseudonymous NFT cases because the DPRK IT-worker fingerprint is well-characterized across the broader 2024-2025 cohort. The ZachXBT attribution — Korean-language GitHub settings, Astral VPN, Asia/Russia timezone, repeated small-value MEXC deposits — is the canonical DPRK IT-worker fingerprint that generalizes across the cohort. The case sits at the boundary between pseudonymous-attribution (no named individual) and inferred-attribution (country-level actor attribution via the DPRK IT-worker operational fingerprint).

For defenders, the case reinforces the standing lesson that NFT project teams must treat the developer hiring process as a security control surface and must apply the same access-control principles to NFT smart contracts that DeFi protocols apply to treasury multisigs: multisig ownership, timelocked administrative functions, and per-developer access scoping. A sole-EOA contract ownership model combined with an unvetted developer hiring process is T15.001 + T9.004 exposed by construction.