Stolen ENS Name

🪳 Bug Reports
#1

I noticed recently that one of my NFTs, an ENS domain, “robloxian.ens”, was missing from my collection. The transfer out of my wallet happened about a week ago without my knowledge. I see now that the entity which took my NFT is attempting to sell it (along with many other NFTs) on multiple sites.

I originally minted the ENS domain in November of 2021 with my Metamask wallet address 0x361fC0ED3D5a3d0bDfDfde855E46d9c04de6b7eE, and sometime shortly after transferred it to my CoinBase wallet address 0x2d63bf0766c94d54955b6cb4044babe6b0b58bab. My Metamask wallet is still the “controller” on the ENS website, but address 0x6F69D2Efe0e663506d4Ee3A5DdB72D14aE8f8D56 (whoever this is) is now the “registrant” and can do with the name as they wish?

Also, maybe they blocked me, but I cannot view this person’s OpenSea account. I can see what they are selling (along with my ENS domain) on x2y2.io.

I don’t know how this happened, but this looks to be the only thing missing from my wallet. I will include a bit more information below.

Sorry for the long read. Thank you in advance for any help that can be given.

Contract: 0x57f1887a8BF19b14fC0dF6Fd9B2acc9Af147eA85

Transaction: 0x1956c0c59910e308ad5c59ff4512ba32995661920a03c34218025f6747b64a0c

3 Likes
#2

This person has hundreds. However, you look fine.

Here is the etherscan.io address to give you more detail (you may have to cut and paste it in the address for for it to work.: https://etherscan.io/nft/0x57f1887a8bf19b14fc0df6fd9b2acc9af147ea85/67097296871932894758963474198776621727028246053106555307209112091009041433579

Here is it on opensea: https://opensea.io/assets/0x57f1887a8bf19b14fc0df6fd9b2acc9af147ea85/67097296871932894758963474198776621727028246053106555307209112091009041433579

It looks like the thief’s account was just locked by opensea.

Nevertheless, it looks like your okay: In https://app.ens.domains your metamask wallet is the Controller and your CoinBase wallet is the Registrant.

If I’m correct, you will need to email opensea.io a notarized statement to withdraw your claim of theft and unlock it. I’m going through this now.

2 Likes
#3

Thanks for the info! Yet, my CB wallet is not the controller or the registrant (as far as I can tell).

0x6f69d2efe0e663506d4ee3a5ddb72d14ae8f8d56 Is the current registrant (not my address). Please correct me if I’m missing something.

0x361fC0ED3D5a3d0bDfDfde855E46d9c04de6b7eE: The wallet I registered the name with, before sending it to my other wallet: 0x2d63bf0766c94d54955b6cb4044babe6b0b58abab. After that, about a week ago, the registrant was changed to that new address ending in 8d56…

Weird that my Metamask wallet is still the controller, but only until they realize their mistake by not changing it?

Ugh… As I said, I might just buy this name back from the thief since it’s for my son in the end. Unless there’s some other way to get it back?

Thanks again for your help:

Summary:

0x6f69d2efe0e663506d4ee3a5ddb72d14ae8f8d56 = Thief/current registrant

0x361fC0ED3D5a3d0bDfDfde855E46d9c04de6b7eE = My wallet, used to purchase the name and current controller

0x2d63bf0766c94d54955b6cb4044babe6b0b58abab = My wallet, sent the name several months ago to hold for my son.

1 Like
#4

I did also just notice, this address (0x6f69d2efe0e663506d4ee3a5ddb72d14ae8f8d56) is the registrant of a BUNCH of names, true. But the controller of none. That alone is suspicious, is it not? Man I hate thieves…

2 Likes
#5

No, it’s not. I was mistaken about the Controller wallet.

1 Like
#6

It’s a LITTLE odd to me, but I suppose you’re absolutely correct; it’s not in itself something that should cause suspicion. I do know though that this particular ENS name was stolen by this person, so I would guess that at least several (if not all) the other ENS names in this account are “missing/stolen” as well.

Thanks so much for your help looking into this. Am I correct in assuming there is no recourse for me?

1 Like
#7

Not unless it is transferred. If that happens, then let me know.

1 Like
#8

Will do. I’ll keep my eye on it if not just buy it back outright.

Thanks again friend.

1 Like
#9

Wow! I got a response from the one who stole “my” ENS name (it’s actually my 11 year old son’s, and I let them know that). I offered 0.025ETH for it, and this is their response:

image
image496Ă—590 34.2 KB

1 Like
#10

There really are some pretty awful people out there. Karma will take care of it all though, I’m 100% sure of this…

And yes, $50 is A LOT of money for us right now.

What a prick…

#11

Was this just transferred to you? Opensea shows it was transferred 6:47 EST 5/13/2022

#12

I just bought it from them for 0.05 ETH. My son’s name is more important to me than being ripped off. Oh well. Live and learn. I’ll be more careful with my addresses and confirmations in the future.

1 Like
#13

Well you have it. I felt the same way when I was scammed out of my wife’s NFT. Luckily, I was able to convince the subsequent owner to transfer it back to me. I still have two, which are sitting in limbo.

It looks like the thief closed their opensea account.

2 Likes
#14

I know a lot about karma having lived on the other side for much of my life. I’ve changed, and maybe this person will too. But in the end, maybe I made a mistake and made myself vulnerable to an attack like this at some point. I’m more aware now, so maybe it’s a good lesson. I’d rather take the lesson and be square with myself than go on hating this person and losing my kiddo’s ENS name. (small matter, but important to me)

They can do what they want with their life, but stuff like this will certainly weigh the balance against them at some point. I have to be content with that. It’s done. I lost ~$100. Better than having dirt on my hands.

2 Likes
#15

Thank you so much Berrios. It’s good to know people like you. Sorry about your losses, but it will all even itself at some point. Just have to take these things as lessons with a silver lining

2 Likes
#16

I would like to learn how to forensically track wallet transactions, because somewhere there is an email address and other identifier that could help me track the person’s identity.

2 Likes
#17

Please let me know if there is something that I can do to help you. I gave up in this particular case bc I didn’t want to continue to fight. But for others, justice is something worth more than my own piece of mind. Thank you again friend

#18

I agree. It would take time (or coding and algorithms), but I absolutely believe that everything can be traced. Wallet addresses are anonymous, to a degree, but there’s always a digital trail. I just didn’t have the time or patience to wait for this

#19

Just wanted to make sure - you both are using new wallets, right? Not the one that was compromised? Also can’t hurt to look into anti-malware software. I recommend Malwarebytes.

3 Likes
#20

New wallet and new computer on my end. Should be secure. Fingers crossed

2 Likes