Cybersecurity researcher ZachXBT has exposed a string of sophisticated attacks resulting in nearly $1 million of losses across several NFT protocols. Attackers posed as trusted IT insiders, embedding themselves into development teams for platforms such as Favrr, Replicandy, and ChainSaw. Their goal was straightforward: sneak malicious code into minting contracts, mint thousands of NFTs, dump them, and collapse floor prices all in under a week.
ZachXBT traced the attacks to a single North Korean linked cluster, shedding light on how exploitation combines social engineering and onchain plumbing. In one documented case, attackers inflated mint counts before pushing doctored transactions to production, siphoning funds into hidden addresses. Replicandy reported a massive volume spike that triggered alarms, but by then the financial damage had been done.
These intrusion tactics underscore a growing trend where open-source teams are infiltrated via duplicitous onboarding. Security experts warn that traditional perimeter protections are futile when threats originate from within. Recommendations include zero trust engineering models, multi signature deployment gates, and continuous transaction pattern monitoring.
The incident also spotlights maintainers’ need for exhaustive code audits and regular external reviews. Wallet management must decouple deployment from minting logic to prevent rogue mint creation. Several projects have undertaken emergency audits following the breaches, and some core contributors have temporarily suspended minting privileges.
With more than $1 million lost, this episode ranks among the costliest insider-driven NFT exploits. Platform developers are now reviewing internal workflows, expanding security teams, and embracing hardened deployment pipelines. The hope is that greater onchain transparency paired with offchain diligence can stem a wave of future protocol-level attacks.
