What happened
On January 24, 2022, at least five buyers used old OpenSea listings to buy at least 12 NFTs far below market value. The NFTs came from Bored Ape Yacht Club, Mutant Ape Yacht Club, Cool Cats and CyberKongz, and Elliptic estimated their market value at about $1.1 million. The listings no longer appeared on OpenSea, but the sellers' signed orders were still valid on-chain. OpenSea listings at the time had no default expiry.
At around 7 am that day, one buyer bought Bored Ape #9991 for 0.77 ETH (about $1,800) and resold it about 20 minutes later for 84.2 ETH (about $196,000). One buyer, jpegdegenlove, paid about $133,000 for seven NFTs, sold them for about $934,000 in ETH, and within five hours sent the ETH through Tornado Cash. The same buyer later sent 20 ETH back to one victim and 13 ETH to another. OpenSea added an inactive-listings view so users could see and cancel old orders, and reimbursed affected users about 750 ETH (about $1.8 million at the time).
How it happened
- A seller listed an NFT on OpenSea by signing an off-chain sell order at a fixed price.
- To avoid paying gas to cancel, some owners moved the NFT to another wallet and back. The listing then disappeared from OpenSea's interface, but the signed order was never cancelled on-chain.
- Buyers found these old orders and filled them by calling the exchange contract directly.
- The exchange contract checked only the signature and the order terms, so the sale went through at the old, much lower price.
- Buyers resold the NFTs at market prices. Some owners also lost NFTs while cancelling orders one by one, as bots filled orders that had not yet been cancelled.
Protocol details
Funds Recovery
Recovered
$75K
Net Loss
$943,872
Evidence
- report @_lut1 incident report twitter.com
- transaction etherscan.io transaction 0x8c73…bf9c etherscan.io
- transaction etherscan.io transaction 0xa471…6bef etherscan.io
- address etherscan.io address 0xb1a2…0c48 etherscan.io
- analysis Bug allows NFTs worth over $1 million to be stolen elliptic.co
- analysis DeFiLlama defillama.com
- analysis OpenSea Refunds $1.8M in Ethereum to Users Who Lost NFTs From 'Inactive Listing' Exploit decrypt.co
- analysis orders.rarible.com page orders….com orders.rarible.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
