What happened
On April 25, 2022, an attacker used Bored Ape Yacht Club's compromised Instagram account to promote a fake LAND airdrop. The link led to a copycat BAYC site that induced holders to connect wallets and sign a transfer approval, allowing NFTs to be moved to the scammer's wallet. Contemporaneous estimates varied; BAYC described about $3 million in assorted NFTs, while another on-chain count found 91 NFTs worth at least $2.8 million at collection floor prices.
How it happened
- An attacker obtained control of BAYC's official Instagram account.
- The account posted a fraudulent LAND-airdrop link to a copycat site.
- The page prompted holders to connect a MetaMask wallet and sign a safeTransferFrom transaction.
- That authorization transferred NFTs from victim wallets to the scammer's address.
Protocol details
Evidence
- report @BoredApeYC incident report twitter.com
- report Report blog.defiyield.app
- report Report thecut.com
- analysis Bored Ape Instagram account hacked: NFTs worth $2.8 million stolen theblock.co
- analysis Bored Ape Yacht Club says its Instagram was hacked to funnel users to NFT phishing sites therecord.media
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
