The Bored Ape would likely fetch somewhere around $125,000 if resold. The other three NFTs would likely resell for somewhere around $8,700. Together with around $3,400 in stolen tokens, Bryant's total loss is around $139,000.
After some observers spotted the suspicious-looking transactions, Bryant confirmed on Twitter: "Yes my ape was stolen and I don't know how this is crazy".
The thief sold all the NFTs and then transferred the proceeds from the sales to their own wallet. Altogether they made off with 127.3 wETH (~$208,000).
On Twitter, hideyoapes explained that they had downloaded and installed the MetaMask wallet extension from MetaMask's official website. "I didn’t think anything of it because it was the legit site and verified chrome app. While I was sleeping all my assets were sold," they wrote. At this point, it's not clear how exactly the hack was perpetrated.
Yuga Labs has said that, following the end of the three-week-long game tournament, the Sewer Passes with non-zero scores in the game will transform into something new, with the idea that higher scorers may receive more valuable NFTs.
This, of course, incentivized users to try to cheat in the game by creating bots, changing the browser-based game code to eliminate obstacles, or access game seeds that allowed them to predict the layout of a course run. Sewer Pass holders began paying others to play their game for them — either more skilled players, or players who were using these tools. Some were charging up to 2.5 ETH (~$4,200) to obtain scores of 700,000 or more for those who hired them.
Yuga Labs has promised to review gameplay to ensure that those who cheated are disqualified. They've also warned people buying Sewer Passes after gameplay ended that if they buy a pass that is determined to have cheated, it will be worthless. Some are skeptical of Yuga's ability to accurately detect cheaters, and others have expressed concern over false positives in the game's cheat detection that appeared to be caused by slower Internet connections.
The thief quickly flipped all of the NFTs for around 417 ETH ($525,000). It's unclear if one of the CryptoPunks was stolen, as it was transferred to a wallet to whom CryptoNovo has previously made transfers, but that NFT too was sold for 75 ETH ($94,200).
The thief made a pretty penny, but the loss to CryptoNovo is more substantial based on how much money they spent on the NFTs. They had purchased the Bored Ape in August 2021 for 30 ETH (then around $100,000), and CryptoPunk #4608 in September 2021 for 290 ETH (then $850,000).
The attack appears to have been phishing-related.
After some back-and-forth, with legitimate-looking contracts and falsified emails appearing to come from the real company's real founding director, the NFT collector was asked to use their crypto wallet to sign a contract, via the fake company partner website that had been set up.
When the collector did so, the smart contract drained the collector's wallet of its fourteen pricey Bored Ape NFTs, then accepted the highest offers that were outstanding on each of the Bored Apes, netting 852.9 ETH. The scammer converted the stolen ETH to the DAI stablecoin, making off with $1,075,000 in DAI.
Yuga Labs is the company behind the Bored Apes NFTs and spinoff projects (Mutant Apes, and Bored Ape Kennel Club), and in March also acquired the blue-chip NFT collections CryptoPunks and Meebits.
A probe does not necessarily mean that Yuga has violated the law, but such an investigation could have major ramifications for the world of NFTs.
NFT trader Laszlo_btc went to swap his Bored Ape #8274 for another Bored Ape after reaching a deal with someone he met on Discord. He opened up Sudoswap to do the swap, but was tricked into trading his pricey NFT for a worthless NFT that was disguised to look like a Bored Ape. This is how Laszlo was scammed out of his first Bored Ape, which he'd only purchased three days prior, for 80 ETH (~$108,000). The scammer quickly flipped the NFT for around 70 ETH (~$92,000).
Realizing he'd been scammed, Laszlo went to revoke the permissions he'd granted in case he'd opened himself up to other thefts. However, instead of using the real permission revocation service Revoke.cash, he ended up using a phishing site: Revokecash.net. Only fifteen minutes after the first theft, six more Bored Apes were transferred out of his wallet.
Altogether, Laszlo had paid over $1.9 million for the collection of seven apes, which he purchased between January and October 2022. The priciest was Bored Ape #2951, which he bought for 173 ETH on May 1 — at the time, $490,000. The two sets of scammers quickly flipped all the NFTs, selling them for a total of $608,000.
Sub-primate lending: $5.3 million in Bored Apes used as loan collateral are at risk of being liquidated
However, NFTs in general haven't been doing so hot lately, and the Bored Apes haven't been immune from the slump. As the Bored Apes collection floor price has decreased, more than 15% of the apes used as collateral for BendDAO loans are in the "danger zone" — close to being auctioned off. These 45 apes are valued at roughly $5.3 million. Liquidation could lead to cascading liquidations, as the auctions could themselves cause the floor price to decrease.
As Bennett Tomlin put it, "I hate that y'all somehow created a risk for cascading liquidations of JPEG backed loans".