Millions of OpenSea user emails now public after 2022 leak

Over seven million email addresses from OpenSea users have been fully exposed online following a data leak that occurred in mid-2022. 

The leak originated from an incident involving OpenSea's email vendor, Customer.io, which compromised user data and has now become a significant concern for security experts. 

In a January 13 post on X, SlowMist's chief information security officer, known as "23pds," warned about the implications of this leak. 

“Remember the attack on the OpenSea mail service provider in [2022] that led to the leakage of emails? The leaked email addresses have now been fully publicized after multiple disseminations,” 23pds stated.

The attack took place in June 2022 when an employee at Customer.io misused their access to download and share OpenSea user emails with unauthorized third parties. 

While the breach was initially reported at the time, the full extent of the leaked data had not been made public until recently. 

“Previously, it was not made public. Now all the leaked data has been made public in its entirety and is available to anyone who wants it,” 23pds explained.

The leaked information includes a substantial number of email addresses belonging to overseas cryptocurrency practitioners, including notable figures and companies in the industry.

OpenSea first alerted users about the data leak on June 29, 2022, advising anyone who had shared their email with the platform to assume they were affected. 

To mitigate risks associated with the leak, 23pds recommended that users create strong and unique passwords and enable two-factor authentication (2FA) where possible.

Phishing scams have become a major security threat, with attackers reportedly stealing over $1 billion in digital assets through various incidents in 2024. 

“Phishing was the most costly attack vector last year,” a spokesperson from CertiK noted previously. 

As the situation develops, users are urged to remain vigilant against potential phishing attempts leveraging the leaked email addresses.