Report: Bored Ape Yacht Club Discord Attacker May Have Been Involved in Previous NFT Phishing Scams

On June 4, 2022, the Bored Ape Yacht Club (BAYC) Discord server was compromised and a phishing scam targeted non-fungible token (NFT) collectors holding BAYC, Mutant Ape Yacht Club (MAYC), and Otherside NFTs. According to an analysis by the Web3 and blockchain auditing and security firm Certik, the BAYC Discord server attacker may have been involved in previous phishing attacks.

While many NFTs are very expensive, it makes them all the more worthwhile for malicious attackers to steal them. This week the Bored Ape Yacht Club (BAYC) Discord server was breached and an attacker used a phishing scam to lure victims.

Certik, the Web3 and blockchain auditing and security firm, published an analysis of the attack and from the company’s account, the attacker may have been involved with previous phishing attempts. The attack occurred on Saturday and a total of 32 NFTs valued at roughly $360K were stolen from blue-chip NFT holders.



The NFTs stolen stemmed from the Bored Ape Yacht Club (BAYC), the Bored Ape Kennel Club (BAKC), Mutant Ape Yacht Club (MAYC), and NFTs from the Otherdeed collection. Certik’s report says the phishing site was a “carbon copy of the official projects website, yet with subtle differences.”

There were no social media links on the site and there was a tab added titled “claim free land.” After some victims were hooked by the phony phishing ad, the attacker received a number of NFTs and then proceeded to sell them.

The attackers managed to acquire 142 ether and Certik notes that it is likely 100 ETH was sent to the mixing application Tornado Cash. Certik summarizes why the researchers believe some evidence shows that a fraction of ether the hacker acquired was sent to Tornado Cash and possibly sent to one address.

“Whilst it’s impossible to be certain that the 99.5 ETH redeemed by 0x2917… are the funds associated with today’s attack, it is certainly probable that these are the stolen funds post mixer due to the 20.5 ETH being sent to the depositor address,” Certik’s report notes.

The Certik researcher’s analysis adds:

The majority of the funds were sent to [Externally Owned Account (EOA)] 0x5bC1…, which is where they remain at the time of writing.

The blockchain security firm says that links indicate that 0x5bC1 is likely “not only associated with the BAYC phishing attack today, but also previous phishing attacks.” The company mentioned the fact that BAYC was targeted on April 25, 2022, when an attacker compromised the NFT collection’s Instagram account.

At that time, the hacker got away with 888 ether worth of non-fungible tokens by posting a scam link to a fake airdrop. “Users were prompted to sign a ‘safeTransferFrom’ transaction,” Certik’s report concludes. Prior to the Instagram exploit at the end of April, on the first day of April, Mutant Ape Yacht Club #8,662 was stolen via a phishing scam posted to the Discord channel. The celebrity Seth Green recently fell victim to a phishing attack and lost his Bored Ape to the scam. Bored Ape #8,398 called “Fred” was supposed to play a role in Green’s new series called “White Horse Tavern.”

What do you think about the recent BAYC phishing scam? Let us know what you think about this subject in the comments section below.