PREMINT | NFT Hack

Reported loss $375K
Ethereum
Access Control

What happened

On July 17, 2022, attackers injected malicious JavaScript into the PREMINT NFT allowlist site (premint.xyz). The script showed visitors a fake wallet-verification prompt that actually requested a setApprovalForAll approval, which let the attackers transfer the victims' NFTs. CertiK counted 314 NFTs taken by six attacker wallets, worth about 275 ETH (~$375,000), including Bored Ape Yacht Club, Otherside, Moonbirds Oddities and Goblintown pieces.

Premint later reported 321 NFTs from 28 wallets and roughly $500,000. Premint traced the injection to a flaw in an open-source image-upload tool for Amazon S3, promised to compensate victims at floor-price snapshots, and told users to revoke approvals.

How it happened

  1. The attacker abused a flaw in an open-source S3 image-upload tool used by PREMINT to bypass upload limits and folder restrictions and modify the site's JavaScript.
  2. The modified site loaded an extra script from a look-alike domain (s3-redwood-labs-premint-xyz[.]com/cdn.min.js).
  3. The script rewrote login and project pages to show a prompt asking users to verify wallet ownership; signing it granted the attacker setApprovalForAll over NFT collections.
  4. Attacker wallets used those approvals to transfer 314+ NFTs out of victim wallets, sold them, and routed proceeds through intermediary wallets toward Tornado Cash.

Protocol details

Classification NFT / Frontend & Infrastructure
Protocol Type Exploit/Access control
Protocol links Website @PREMINT_NFT

Evidence

Understand the attack patterns

Compare incidents →
Access Control Attacks

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes