Leaderboard
642All-time rank
O
OpenSea
Jan 25, 2022
$1.0M
Lost
$1.0M
Recovered
$0
Net loss
$1.0M
Unrecovered0% recovered
OpenSea's listing system contained a bug where transferred NFTs remained listed on the marketplace via the API despite appearing delisted. Attackers exploited this to purchase previously thought-delisted NFTs at old, far below-market prices and immediately resold them for profit.
Three attackers collectively extracted over $1M by buying popular NFTs like Bored Ape Yacht Club at historical listing prices.
- Target
- Other
- Classification
- Protocol Logic
- Technique
- Withdrawal Logic Flaw
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Jan 25, 2022Exploit executed — $1.0M drained via withdrawal logic flaw
- Attributed to Unknown
- Recovery status Unrecovered 0%