NFT collector scammed out of $2.2 million in a phishing attack

December 30, 2021

NFT collector scammed out of $2.2 million in a phishing attack

A Bored Ape NFT: a teal background, with an ape wearing an astronaut suit and a crash helmet with an American flag print. It's biting its lower lip.

BAYC #9410, one of the stolen NFTs (attribution)

Todd Kramer, an NFT collector who had acquired Bored Ape and other pricey NFTs, clicked on a phishing contract that appeared to be a legitimate NFT trader link. Sixteen NFTs from three collections were taken, including eight Bored Ape NFTs. In total, the loss totalled around 593 ETH (equivalent to about $2.2 million).

"I been hacked. all my apes gone." tweeted Kramer, in a phrase that ultimately became a catchphrase of the NFT world (and its critics).

After asking for help on Twitter, OpenSea froze the stolen assets, preventing them from being traded on their platform. Some commenters noted that the redress (asset freezing and flagging of suspicious accounts) was only possible because OpenSea is a centralized platform with a large amount of power in the NFT arena, which some see as antithetical to the supposed ideals of web3. This also raises the question of whether BAYC themselves have a way to determine "legitimate ownership" of their NFTs, which in addition to being expensive status symbols also grant their owners exclusive perks including merchandising rights and access to events.