Millions of dollars of high-value NFTs, including rare Bored Ape and Mutant Ape Yacht Club tokens, World of Women NFTs, VeeFriends, Art Blocks, and more were stolen in a major hack of peer-to-peer trading platform NFT Trader earlier today.
The company confirmed in an X post that “old smart contracts” had been attacked and urged users to revoke any permissions they had given the smart contracts in the past. X user foobar has claimed the attacks have finished after NFT Trader updated its smart contracts to fix a reetrancy vulnerability.
The apparent main attacker posted a public message to the blockchain, pinning the invention of the NFT exploit on another user and claiming the attack was to “pick up residual garbage.” The attacker offered to return tokens to victims after being paid a ransom of 3 eth per Bored Ape and .6 eth per Mutant Ape. The attacker has also made a series of confusing moves, refunding one Bored Ape along with 31 eth to one user and returning certain staked Bored Apes to their owners, while keeping the ApeCoin rewards.
Aside from the main hacker, there have been reports of auxiliary hacks that have drained tokens such as Cool Cats and Squiggles from users’ wallets. NFT Trader did not immediately reply to a request for comment from The Block.
