A hacker stole $ 1 million worth of Bored Ape series NFTs

Bored Ape Yacht Club is one of the most exclusive communities of NFT owners, with some of its members being Hollywood stars. Many of the NFTs with “bored monkeys” are worth in the area of ​​hundreds of thousands of dollars, some being even estimated at a few million, depending on the rarity of their characteristics. Thus, it is not surprising that this community is often the target of cyber attacks, and one attacker recently managed to “steal” Bored Ape NFTs and other “crypto” assets worth about $ 3 million.

The attack was carried out through the Bored Ape Yacht Club Instagram account

The attack was a fairly “standard” phishing attack. The attacker took control of the official Instagram account of Bored Ape Yacht Club and sent to those who own the NFTs that they will offer a new “airdrop” of exclusive NFTs for members. This message included a link that appeared to be the official BAYC site, but which led to a fake site. In order to receive the new NFT, users had to log in with their personal wallet, at which point the attacker transferred all its contents to their personal wallet.

According to the first reports, four of the Bored Ape NFTs were stolen, the most valuable of which was the number 6623, which was previously sold for 123 Ethereum, ie about 300,000 euros. In all, the stolen monkeys were worth about $ 1 million. The rest of the money up to $ 3 million is in other NFTs and virtual currencies that the victims had in their wallets.

At the time of the hack, two-factor authentication was enabled and security surrounding the IG account followed best practices. We’ve regained control of the account, and are investigating how the hacker gained access with IG’s team.

– Bored Ape Yacht Club (@BoredApeYC) April 25, 2022

Bored Ape Yacht Club acknowledged this hack on Twitter, but also confirmed that they have now regained control of the account. It appears that the attacker was able to bypass Instagram’s security measures, despite the fact that best available account security practices were used:

“At the time of the hack, two-step authentication was on, and the security around the Instagram account was following best practices in the field. We’ve regained control of our account and are investigating how the hacker gained access to it using the Instagram team. “said BAYC representatives.

source: Engadget