On June 4, 2022, the Bored Ape Yacht Club (BAYC) Discord server was compromised and a phishing scam targeted non-fungible token (NFT) collectors holding BAYC, Mutant Ape Yacht Club (MAYC), and Otherside NFTs. According to an analysis by the Web3 and blockchain auditing and security firm Certik, the BAYC Discord server attacker may have been involved in previous phishing attacks.
While many NFTs are very expensive, it makes them all the more worthwhile for malicious attackers to steal them. This week the Bored Ape Yacht Club (BAYC) Discord server was breached and an attacker used a phishing scam to lure victims.
“Our Discord servers were briefly exploited today,” the BAYC creators Yuga Labs wrote after the incident. “The team caught and addressed it quickly. About 200 ETH worth of NFTs appear to have been impacted. We are still investigating, but if you were impacted, email us at discord@yugalabs.io. As a reminder, we do not offer surprise mints or giveaways.” The NFTs stolen stemmed from the Bored Ape Yacht Club (BAYC), the Bored Ape Kennel Club (BAKC), Mutant Ape Yacht Club (MAYC), and NFTs from the Otherdeed collection. Certik’s report says the phishing site was a “carbon copy of the official projects website, yet with subtle differences.” There were no social media links on the site and there was a tab added titled “claim free land.” After some victims were hooked by the phony phishing ad, the attacker received a number of NFTs and then proceeded to sell them. The attackers managed to acquire 142 ether and Certik notes that it is likely 100 ETH was sent to the mixing application Tornado Cash. Certik summarizes why the researchers believe some evidence shows that a fraction of ether the hacker acquired was sent to Tornado Cash and possibly sent to one address. “Whilst it’s impossible to be certain that the 99.5 ETH redeemed by 0x2917… are the funds associated with today’s attack, it is certainly probable that these are the stolen funds post mixer due to the 20.5 ETH being sent to the depositor address,” Certik’s report notes. The Certik researcher’s analysis adds: The blockchain security firm says that links indicate that 0x5bC1 is likely “not only associated with the BAYC phishing attack today, but also previous phishing attacks.” The company mentioned the fact that BAYC was targeted on April 25, 2022, when an attacker compromised the NFT collection’s Instagram account. At that time, the hacker got away with 888 ether worth of non-fungible tokens by posting a scam link to a fake airdrop. “Users were prompted to sign a ‘safeTransferFrom’ transaction,” Certik’s report concludes. Prior to the Instagram exploit at the end of April, on the first day of April, Mutant Ape Yacht Club #8,662 was stolen via a phishing scam posted to the Discord channel. The celebrity Seth Green recently fell victim to a phishing attack and lost his Bored Ape to the scam. Bored Ape #8,398 called “Fred” was supposed to play a role in Green’s new series called “White Horse Tavern.” 免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
