Azuki Twitter Account Hacked, Attacker Drains Over $750,000 In 30 Minutes

A sudden hostile takeover of the gold-checked Azuki Twitter account left some users falling for yet another wallet-draining scam on Friday.

In less than 30 minutes, over $750,000 worth of USDC, 11 NFTs, and over 3.9 ETH were stolen through malicious links posing as a “land coin” for the popular Azuki NFT project. However, the coin was fake and the link instead sent unsuspecting users to a “drainer” contract tricking them into signing a transaction that removed assets from their wallets.

A single user apparently accidentally sent over $750,000 worth of stablecoin USDC to the attacker’s wallet, according to Etherscan data provided by Web3 security firm WalletGuard.

Many NFT traders quickly realized that the suspicious Azuki tweets, which referred to the fake “surprise coin”, meant that their account was compromised. Within an hour, the official Azuki Twitter account appeared to be removed from Twitter’s search results, and the malicious tweets were deleted.

Azuki Community Manager Rose quickly confirmed that the Azuki account had been compromised.

MetaMask Security Research Harry Denley noticed the scam almost immediately and said MetaMask has since blocked the malicious domain.

The Phantom wallet team has also flagged the malicious domains as unsafe and alerted users who try to connect their Phantom wallets to the sites.

An hour after the account was compromised, Azuki Head of Community and Product Manager Dem said in a Twitter Space that the Azuki team is in contact with Twitter and is trying to regain control of the account.

“We are on top of the situation,” he said.

This is not the first time the NFT collection has been targeted by fraudsters. In April 2022, a deluge of compromised verified Twitter accounts with Azuki profile pictures promoted airdrop scam in an attempt to capitalize on the anime-inspired brand. And earlier this week, the Twitter account of trading platform Robinhood was similarly hacked to promote a crypto scam, although in this case the hackers were only able to make off with about $8,000 in crypto.