What happened
On December 21, 2021, attackers took over the official Discord of Monkey Kingdom, a Hong Kong-based Solana NFT project, just as its Baepes presale opened. According to the team, the intrusion started with a breach of Grape, a Discord member-verification tool popular on Solana, which gave the attacker control of an administrative account. When the presale began, a phishing mint link was posted in the project's official Announcement channel. Throughout the day, thousands of bots impersonating Monkey Kingdom and Baepes announcements had also been sending users direct messages pointing to fake sites.
Buyers who connected their wallets to the fake mint site lost about 7,000 SOL, roughly $1.3 million at the time. One victim reported losing 650 SOL. The team announced a compensation fund and began processing claims on December 22.
Reported attacker address (not re-verified on-chain): HuiYfmAceFkmhu3yP8t3a6VMYfw3VSX2Ymqqj9M2k9ib. Reported Wormhole bridge transactions, said to total 316.8 WETH:
oUbXHMm158RtzoGD3k5ys3y9SiBovQ1smKWANo1QmX144ovmz9bDsUWyhr3Yp9uEnUVZnnLMgXSxDjFvAVJtBs147YYx62nvoeuVenY5iT4GA4LYiiNHd9nYmix69rVxw4DZU3FycQWbPy6ePWirMBEDEFfH3a5jW9wjzsuHFtzxz3D2pM5asqypGSjJSZjNf6m6MjoQWsc9vFg91UosukpSbZbxwN3BwmaFRnSa3vFERyZBzGDjTTxKD1h1dKkiaPfsjBt4MrJuXHeJLH2cBTzYT9Gjbe8pcXvHsRnF5E5ZnpGVkQ7v3gvDEchWVijMSWjwkF1FyxJXV1yjABs4HWh9tcDqaoM
How it happened
- The attacker exploited a breach in Grape, the Solana verification tool connected to Monkey Kingdom's Discord, and used it to take over an administrative account.
- On December 21, thousands of bots impersonating Monkey Kingdom and Baepes flooded the server and sent direct messages linking to fake sites.
- When the Baepes presale started and the real website was under heavy traffic, a phishing mint link was posted in the official Announcement channel.
- Users who trusted the channel connected their wallets to the fake site and approved transactions, which transferred their SOL to the attacker, about 7,000 SOL in total.
- Monkey Kingdom set up a compensation fund and started contacting affected buyers the next day.
Protocol details
Funds Recovery
Recovered
$1.3M
Net Loss
$26,000
Evidence
- report @MonkeyKingdom_ incident report twitter.com
- transaction solscan.io transaction 2pM5as…sjBt solscan.io
- transaction solscan.io transaction 47YYx6…xz3D solscan.io
- transaction solscan.io transaction 4MrJuX…qaoM solscan.io
- transaction solscan.io transaction oUbXHM…tBs1 solscan.io
- analysis Hong Kong NFT project Monkey Kingdom loses $1.3M in phishing hack, launches compensation fund cointelegraph.com
- analysis DeFiLlama defillama.com
- analysis Solana-Based Hacked Monkey Kingdom Has a Phishing Lesson for NFT Buyers (cryptonews, republished) thebittimes.com
- analysis The Monkey Kingdom hack: a shining example of what to do in a crisis (Alisa Jwani blog copy of Arabian Business opinion piece) alisajwani.ae
- analysis solscan.io address HuiYfm…k9ib solscan.io
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
