Premint

On July 16-17, 2022, Premint's frontend was compromised via a vulnerable open-source image upload tool that allowed an attacker to inject malicious JavaScript into a library file. The attacker created a malicious domain and updated the JavaScript to redirect to their code, which then tricked users into signing setApprovalForAll transactions, allowing theft of 314 NFTs including Bored Apes and Moonbirds.