Nft Trader Hack

What happened

On December 16, 2023, attackers took high-value NFTs from wallets that retained approvals to NFT Trader's old Ethereum trading contracts. NFT Trader warned users to revoke access to two compromised contracts; contemporaneous reporting described the thefts as worth millions of dollars.

How it happened

1. Users had retained approvals to NFT Trader's old trading contracts.
2. Attackers used the affected old contracts to transfer approved NFTs from those wallets.
3. The thefts included high-value collections such as Bored Ape Yacht Club, Mutant Ape Yacht Club, World of Women, VeeFriends, and Art Blocks.
4. NFT Trader told users to revoke permissions to the two compromised contracts.

Protocol details

Classification NFT / Exchange (DEX) / Reentrancy

Protocol Type Exploit/Reentrancy

Implementation language Solidity

Protocol links Website @NftTrader

Evidence

• report @NftTrader incident report twitter.com
• analysis Web Archive archive.ph
• analysis DeFiLlama defillama.com
• analysis Hackers steal NFTs worth millions, from Apes to Art Blocks, in NFT Trader exploit theblock.co
• analysis Explained: The NFT Trader Hack (December 2023) halborn.com

Understand the attack patterns

Compare incidents →

Reentrancy