Bored Ape Yacht Club NFT account hacked: over 3 million dollars taken

Bored Ape Yacht Club, the most well-known digital art collection on NFT, was hacked on Monday. Yuga Labs, the multi-million dollar collective that has issued certificates of authenticity to the web’s most popular monkey, recognizes the problem with its internal system. The loot is from more than 3 million dollars.

The attacker took control of BAYC’s Instagram account and sent a phishing post that tricked many followers into clicking, connecting their crypto wallets to the hacker’s “smart contract,” a mechanism for executing a transaction. cryptographic. This is what, ultimately, deceived users.

The mechanic allowed the attacker to steal the assets in the wallets, which controlled the four Bored Apes, as well as a host of other NFTs with a total estimated value of 3 million dollars.

NFTs are certificates of authenticity for something that exists in the digital world, not material. The meaning of its initials “Non-fungible token”. A token is a digital asset that in this case is integrated into a blockchain (Ethereum and Solana) and that it is “non-fungible” indicates that it cannot be replaced.

Fungibility means that one thing is replaceable and unrecognizable: a thousand Argentine peso bill can be exchanged for any other thousand Argentine peso bill. Tokens, like works of art, are not available because there is no way to replace them: the first tweet in history was just oneas there is only one original Pietà by Michelangelo.

The statement and other cases

The Instagram page of Bored Ape Yacht Club and Discord was hacked, where the perpetrators posted about a new NFT mint and what it was called “sale of land” to steal certificates.

Thus, many customers were deceived by seemingly official messages and clicked on a link connected to their wallet, which then transferred its contents to cybercriminals.

“This morning, the official BAYC Instagram account was hacked. The hacker posted a fraudulent link to a copy of the BAYC website with fake Airdrop, asking users to sign a ‘safeTransferFrom’ transaction. It transferred your assets to the scammer’s wallet“, they explain to Discord.

“Two-factor authentication is enabled and security practices are tightened around the IG account,” Yuga Labs of the Bored Ape Yacht Club wrote in a statement to Motherboard.

“Yuga Labs and Instagram are currently investigating how the cybercriminal gained access to the account. we are still investigating. The estimated estimated losses due to the scam are 4 Bored Apes, 6 Mutant Apes, and 3 BAKC, as well as various NFTs estimated to total $ 3 million. We’re actively working to reach out to affected users. “

This is not the first time the theft of these attributes has occurred. In early April, for example, a pseudonymous owner, “s27”, lost a collection of monkeys worth $ 500,000 after being tricked into trading it for fakes: The scammer created new NFTs that were visually identical to the BAYC images, unless they had a green tick. It did this by mimicking the “verified” platform icon used for the exchange.

In December, another Ape holder, New York art dealer Todd Kramer, announced his own $ 2.2 million loss in a tweet: “I was hacked. All my monkeys are gone. Just sell it please help me. ” Kramer, who was the victim of a similar phishing scam, recovered a portion of his stolen monkeys with the help of the OpenSea NFT trading platform.

Finally, earlier this month, a North Korean hacking outfit called Lazarus stole more than $ 500 million worth of crypto tokens from the video game Axie Infinity.