Cyber Incident Victim: Mike Winklemann
Date:
May 2022
Location:
United States of America
Summary
The Twitter account of prominent NFT artist Beeple was compromised via a phishing scam, leading to fraudulent posts promoting fake exclusive NFT collaborations and giveaways. Clicking the malicious links resulted in automatic theft of one Ethereum per victim from connected crypto wallets, collectively draining approximately $71,000. The artist regained account control within hours, emphatically warning followers that such surprise mints were scams, while affected users reported losing high-value NFTs and questioned potential restitution given the attack's origin from a verified account.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On May 22, 2022, the verified Twitter account of Mike Winklemann, the digital artist known as Beeple, was compromised by an unauthorized party. The attacker posted two fraudulent tweets from the account. The first promoted a fabricated exclusive NFT collaboration with luxury brand Louis Vuitton, while the second falsely announced Beeple would release a set of NFTs for free. Both tweets contained malicious links that initiated automated cryptocurrency theft when clicked. Users who interacted with these links had exactly one Ethereum (ETH) drained from their connected crypto wallets without further authorization. This phishing scheme resulted in the theft of approximately $71,000 worth of cryptocurrency from multiple victims within hours. Winklemann regained control of his Twitter account within a few hours of the initial compromise and promptly deleted the fraudulent posts.
Upon restoring account access, Winklemann issued a public warning tweet stating, "Stay safe out there, anything too good to be true IS A F******G SCAM," explicitly disavowing the legitimacy of surprise NFT mints promoted through single announcements. Affected users replied to his tweet with firsthand accounts of their losses, including one victim who reported losing their "only blue chip NFT" after seeing the fraudulent tweet moments after posting. Multiple respondents questioned whether Winklemann would compensate victims, citing his verified account status as lending credibility to the scam. No public statements from Winklemann or his representatives addressed restitution, and Fortune reported receiving no response to inquiries about the incident. The attack demonstrated direct financial consequences for users who trusted content from a compromised verified account, with no disclosed follow-up actions beyond the account recovery and initial warnings.