At Least $360,000 in NFTs Stolen From BAYC After Hack

For the third time, hacking and theft hit the largest non-fungible token (NFT) collection Bored Ape Yacht Club (BAYC), with the hackers stealing an estimated 20 Ether (ETH), worth $360,000 in NFTs. The security breach happened on Saturday, June 4.

Twitter user NFTherder first reported the hack on June 4, “who also estimates 145 ETH (around $260,000) was stolen along with the NFTs, tracing the stolen funds back to four separate wallets.

‘Still Investigating’

Parent of BAYC, Yuga Labs, followed up on NFTherder’s tweet many hours later with this tweet:  “Our Discord servers were briefly exploited today. The team caught and addressed it quickly. About 200 ETH worth of NFTs appear to have been impacted. We are still investigating, but if you were impacted, email us at discord@yugalabs.io.”

According to a spokesperson for Yuga Labs, BAYC’s parent, on Monday, June 6, the company has no further information to report.

The hack happened after project community manager Boris Vagner’s Discord account was breached and the attacker then posted phishing links in both the official BAYC and its related metaverse called Otherside’s Discord channels.

A BAYC founder Gordon Goner blamed Discord for the security breach, but Steve Fink, another crypto founder, told Fortune: “You lost your NFT because you signed a malicious transaction with your key. Stop blaming Discord, another client won’t save you from repeating the same mistakes.”

A Banner Year in 2021

The Miami-based blockchain company Yuga Labs launched BAYC, a collection of 10,000 unique Bored Ape NFTs, in April 2022. It followed up with Mutant Ape Yacht Club (MAYC) a few months later. By the end of 2021, it had pulled in $127 million; this year, it made two acquisitions.

Saturday’s hack marks the third time an actor has posed as a Yuga-Labs-run account to steal users’ funds. The first and second were on April 1, when Mutant Ape Yacht Club #8662 was stolen through a phishing link posted in the project’s Discord, and on April 25, following the posting of a fake link to an Otherside minting coming from BAYC’s  Instagram and Discord accounts.

The Bottom Line

A BAYC founder blamed Discord for its security breach, but one observer didn’t have it, saying you “signed a malicious transaction with your key.” Meanwhile, parent company Yuga Labs tweeted that it is “still investigating” the hack.”