Today the Gods Unchained discord server was hacked. Again.
If you are like many people you may be asking yourself are you compromised? What can you do to protect yourself? Why did this happen?
So now that it has happened, what should you do?
So a discord posting had a flash mint and you followed a link to a website and connected your wallet?
If you didn’t go further than just allowing the bad guy’s website to see your wallet address and public keys (permitted accounts) you should be fine. Afraid they have your wallet address now and can target you? Well, this is the blockchain, every time you mint an NFT everyone can check that NFT’s wallet address and see that your wallet’s address bought the NFT. This would be akin to being overly concerned somebody knew your checking account number at your local bank. Ever notice that account number is printed on every check you write? It isn’t exactly hidden information. Neither is your Metamask wallet’s address.
Still, there is no reason to remain connected to websites you no longer need or don’t want to be connected to. Go ahead and disconnect your wallet from any website you don’t use on a regular basis.
In Metamask:
Click on the vertical ellipses to the right of your account number after you click on your Metamask account:
Select “Connected sites” in the drop-down menu:
For any website you don’t recognize or don’t use on a regular basis click on the trash can.
Confirm you wish to disconnect your wallet from this website.
Don’t worry about disconnecting from a website you want to connect to in the future, you can always re-connect.
For Metamask mobile or additional screenshots of the process you can review: Metamask's instructions on how to disconnect a wallet from a Dapp.
I’m sorry to report you likely need to just accept the loss. In the case of a discord hack where an official channel offered up a fraudulent mint link you may be in luck. The better companies, Gods Unchained included, have reimbursed victims for their losses. They don’t need your wallet address to do this (remember everything on the blockchain is open, they can find the amount you paid and reimburse you).
If you think you may have signed a sophisticated contract, shared your wallet’s QR code, or revealed your private keys/seed phrases then you need to act fast. You’d need to create a new wallet and start transferring your assets to your new wallet.
For Gods Unchained you can send your cards to your new wallet by using Token Trove and Once logged in with your old wallet you can use the transfer option when looking at a the bottom left of a card you own:
Don’t be a victim…many of us are so tired of seeing the advice below, but please read it once again:
I know it may be easy to throw some shade at the Gods Unchained team for these hacks and there is plenty of blame to go around whenever instances like this happen. This particular hack seems to be the result of the team missing a bot that was slipped in by the hackers.
The Gods Unchained discord hack from January 4th followed along the lines of several other similar attacks. Calling this a hack doesn’t paint a complete picture. Many people will hear the word “hack” and assume there was a software vulnerability exploited or malware used to compromise the system.
Instead the compromise has a lot more to do with social engineering, or tricking somebody to divulge sensitive information. The first time I read about this discord “hack” was from Jenkens the Valet in December. Their explanation of the incident is worth reading if you have the time. In the end it comes down to the bad guy tricking a good guy into showing a code that bypasses Discord’s security for the account, in this case a moderator or admin account. Even if 2fa (two-factor authentication) is turned on the account can still be compromised.
This isn’t limited to Discord. A Bored Ape NFT Collector lost millions of dollars in NFTs to a similar social engineering hack, but this time with Metamask. While the features are in these programs to make it easier on us, the end users, we still need to practice due diligence to avoid being scammed.
Staying safe while playing Gods Unchained is no different than staying safe online…..or at the supermarket for that matter. Be cautious of strangers, don’t divulge information, and protect your sensitive information. We don’t need to run away to the mountains to be safe, but we do need to be on our toes.
But still have fun, get out there and clobber some other mortals!
