OpenSea accused of theft, negligence and extortion by user who sues NFT Marketplace for $500,000
OpenSea has a security and fraud problem, and if one NFT market account holder is right, it is negligent in protecting its customers and guilty of extortion.
As a prominent NFT creator, collector and venture capitalist Kevin Rose will no doubt confirm that theft in the NFT space is a serious problem. He lost part of his personal collection worth $1.1 million in a recent phishing attack, although it had nothing to do with OpenSea.
Robert Acres, who we describe below, was also the victim of an NFT phishing attack. Not as high-profile a user of OpenSea as Rose, Acres had two NFTs stolen in a phishing attack.
He claims that far from immediately trying to help him retrieve his property and prevent resale of the thieves, as OpenSea is reported to have done with Rose, the leading NFT marketplace ended up locking Acres out of his account for three months.
During that time, Acres claims he suffered heavy losses on the 58 NFTs in his account because he was unable to trade them.
The two now blacklisted stolen NFTs can be seen listed on OpenSea, with a warning that the items cannot be bought or sold due to suspicious activity:
https://opensea.io/assets/ethereum/0xd2f668a8461d6761115daf8aeb3cdf5f40c532c6/2299
https://opensea.io/assets/ethereum/0x4db1f25d3d98600140dfc18deb7515be5bd293af/5297
Acres’ stolen NFTs were sold by the thief for 0.5 and 0.7 WETH.
However, Acres estimates his loss as a result of not being able to trade his remaining NFTs on OpenSea at as much as $500,000, and is suing the NFT market – OpenSea is a trading name for Ozone Networks Inc – to cover those losses.
He has engaged the services of Traverse Legal, with managing partner and trial lawyer specializing in blockchain and web3, Enrico Schaefer, leading the team.
Caption: one of the stolen NFTs: https://opensea.io/assets/ethereum/0xd2f668a8461d6761115daf8aeb3cdf5f40c532c6/2299
OpenSea user says he was banned from his account after complaining
Acres claims that when he complained about OpenSea’s slow response to the theft, that’s when the marketplace locked him out of his account.
According to the time-stamped support communication with OpenSea seen by Cryptonews, dated July 12, 2021, the day the theft took place, Acres informed OpenSea of the theft prior to the sale of the stolen NFTs on the marketplace.
The transaction hash for the theft is displayed on etherscan and the timestamp at 13:38 UTC: https://etherscan.io/tx/0xa6bc538181d79b342cd69042eac74b9a64a1aeb99ed05d98d3f5c09a6f7bf59d
The sale took place one hour later at 02:38 UTC: https://etherscan.io/tx/0xd2327c65e66d0ac94282580f0a8d64d1cd155faa53d7613565d55c6ed9862b25
The email reporting the theft to OpenSea support is timestamped at 02:11 UTC.
The Tx hashes show that half an hour passed between OpenSea being notified of the theft and the subsequent sale on the marketplace.
Admittedly, it could be argued that the half-hour window did not give OpenSea much time to react, but if this were legacy finance, where automated monitoring systems are in place, processes would be in place to quickly stop suspicious activity.
However, due to the lack of measures to prevent resale, it may be reasonable to conclude that OpenSea does not appear to have had sufficiently robust systems in place to be able to respond to such alerts from users in a timely manner.
OpenSea’s initial response appears to be deliberately disingenuous
In part, in its only public statement on the matter to date, an OpenSea spokesperson stated: “The theft in question took place outside of OpenSea and the items were sold before OpenSea became aware of the reported theft. Soon after we were notified and became aware, we disabled the items and the user’s account has since been unlocked.”
The first clause of the first sentence is correct – it was a phishing attack that had nothing to do with OpenSea. But if Mr Acres is right, the rest of the extract from the statement is wrong. As shown above, OpenSea was informed of the theft before the sale took place.
The second sentence is disingenuous to say the least, as it might be assumed that the user’s account was unlocked soon after the two NFTs were deactivated, which was not the case – Acres’ account was locked for three and a half months.
Indeed, it appears that it was when Acres took issue with OpenSea’s failure to prevent the sale of the stolen NFTs that his account was locked.
In an email to Cryptonews.com, Acres writes:
“Frustrated and believing that OS bore some responsibility for what had happened, I noted that OS should be liable for financial damages. In response, OS locked my account without notice, request or permission.”
Acres goes on to state that “OS required me to swear under oath that my wallet has not been compromised (meaning OS would not be liable)”.
According to Acres’ account, when he refused to comply with the alleged demands of OpenSea, he was locked out of his account. Acres further claims that, as a result of the lockout, OpenSea prevented him from trading his 58 NFTs on the OpenSea market.
OpenSea User Claims NFT Marketplace “Can Seize Your NFT Assets”
Acres writes in his email to Cryptonews.com: “OS represents that users’ NFTs are not in the custody of OpenSea. However, most OpenSea members are not aware that the OS can seize your NFT assets and prevent you from moving or trading your NFTs for days, weeks, months or presumably forever, even if you did nothing wrong.”
The OpenSea help center page clearly shows that the opposite is the case:
“Although we can prevent your items from being bought or sold using OpenSea’s services, your items remain on the blockchain and are not in OpenSea’s custody.”
OpenSea will of course not be able to prevent a user of the platform from trading their NFTs on a competing marketplace. That means OpenSea may not strictly “grab your NFTs,” as Acres claims
But in practice, most of the liquidity available in the NFT market can be found on OpenSea. Here we mostly see the limitations of crypto decentralization in practice as opposed to its theoretical intended outcome.
In a defense of his accusation against OpenSea regarding the lock on his account, Acres told Cryptonews: “When your wallet is ‘locked’ or ‘blocked’, all the items in your wallet are flagged as suspicious and thus regardless of which wallet they are transferred to to they will never be able to trade on OpenSea until they remove the flag against your account.
“Currently OpenSea controls over 60% of all NFT trading volume and when this event happened it was far greater.
“The volume of trade being shared by competitors means you are unable to get the most competitive price and thus adds to the financial losses I have incurred for a wallet lock being placed on me against my will.
“Most individuals who shop on a competitor’s marketplace for operating systems often end up using the OS as a resale market after purchasing from a competitor’s marketplace.
“Then again, in this case all my NFTs would carry this ‘suspicious’ tag when displayed on [the] OS marketplace[;] the new buyer also cannot sell it and when they do their due diligence during the buying process, they would not buy them as resale options would be limited.”
How is this argument likely to play out in a court of law?
OpenSea is accused of attempted extortion
We posed the same question, regarding the complainant being free to trade his NFTs elsewhere, to Acres’ lead attorney, Enrico Schaefer, managing partner at Traverse Legal.
This was his answer.
“OpenSea acquired Mr. Acres’ assets by taking control of his account, which constitutes a right of conversion [lawyer-speak for a form of theft]. This gives individuals who are victims of theft the right to take legal action to recover their damages.
“Essentially, conversion provides an opportunity to bring an action to recover damages for the conversion over their property. Conversion occurs when a person, intentionally and without proper authorization, takes control of another person’s property or funds, thereby limiting their ability to to access it.
“The control does not have to be exclusive. The lack of response from OpenSea and the attempted blackmail to unlock the account must have been a surprise and cause for concern, as it would have been for anyone in a similar situation.”
Why did OpenSea not respond in time once notified of the NFT theft?
Furthermore, Traverse Legal claims on behalf of Acres that OpenSeas had three hours to act before the sale of the stolen NFTs took place on the platform.
“Had OpenSea not waited over three hours to actively engage, the NFT could have been locked and potentially returned to his wallet,” writes Traverse Legal.
In fact, the time between being notified of the theft and the subsequent sale was actually only half an hour, as we mentioned earlier, according to Cryptonews analysis.
Nevertheless, after all the well-documented problems on the site that users face, from insider trading to theft, surely OpenSea should now have implemented systems and processes, automated and human, to immediately pause suspicious activity when flagged.
Leaving aside the timings, surely OpenSea would be able to defend itself on the basis that Acres would have been free to trade its 58 NFTs listed on OpenSea elsewhere?
“This matter is best addressed to Robbie, who experienced the situation firsthand,” Schaefer wrote in an email to Cryptonews.
He continued: “However, I have previously represented clients facing similar issues. The claim that ‘a smaller platform with fewer buyers and sellers’ could have been used instead is not a valid excuse for OpenSea to shirk its responsibility to its platform members .
“OpenSea is the platform of choice for individuals looking to maximize demand and price pressure in the market. Using a platform with significantly lower sales volume would have resulted in a liquidation sale rather than real trading activity.”
The three questions of OpenSea that remain unanswered
What does OpenSea have to say about all this, beyond their initial statement shared with the media?
We sent OpenSea the following questions:
- Why was Mr Acres banned from his account against his will?
- Why was Mr. Acres required to identify himself, as alleged, in order to unlock his account?
- Will Mr Acres receive compensation for losses allegedly incurred during the time he was unable to access his account?
A week later and we have yet to hear back from OpenSea.
It is clearly the height of irony that a marketplace that trades products based on a technology whose utility value is based on its ability to securely assign unique identities to digital and non-digital assets and other property is unable to prevent the spread of fraud . entries and sales of said stolen property.
Does OpenSea put the collection of trading fee revenue above the interests of users?
We gave Acres the last word. On the phone, in a conversation where he agreed that the right time is half an hour when it comes to reporting theft and selling the stolen goods, he nevertheless insisted: “The Major [of his complaint] part is the fact that they locked my account for three and a half months and asked me to perjure myself.
“I fully understand that it is a phishing scam and that I act within 45 minutes to an hour of being alerted myself and then alerting OpenSea – and that I alerted them that it was stolen and that I hope half an hour’s time. that they could take some kind of action – is pretty slim, I totally agree with that.
“But anything that follows that transaction is negligence 101.”
Have you had your account locked by OpenSea before; been the victim of fraud attacks but found OpenSea slow to help; or is a creator of NFTs listed on OpenSea struggling with scammers persistently posting fake versions of your products? In that case, contact Cryptonews at [email protected].
