LOST NFT ASSETS
BORED APE YACHT CLUBAugust 2022

Introduction
In April 2021, Yuga Laps launched The Bored Apes project. BAYC is considered the mostvaluable NFT project launched in 2021 in terms of its community and market size. As of2022, sales of the Bored Ape Yacht Club NFTs have totaled over US $1 billion.In 2012,
Meny Rosen eld released an article introducing the concept of "Colored Coins" for theBitcoin blockchain. The idea behind Colored Coins was to describe a class of methods forrepresenting and managing real assets on the blockchain in order to prove ownership of
those assets. The term was created by eToro CEO, Yoni Assia, along with Vitalik Buterin ina whitepaper called Colored Coins. They proposed an idea of “coloring” a set of Bitcoins todistinguish them from the rest. In that sense, these assets would be non-fungible, so NFT
emerged directly from colored coins.
The rst known NFT was minted in 2014 by Kevin McCoy and Anil Dash, who put a shortvideo depicting McCoy’s wife onto the blockchain. McCoy later sold it to Dash for $4. InOctober 2015, the rst Ethereum NFT project, Etheria, was launched.
In 2017, Larva Labs launched CryptoPunks, an NFT collection that seemingly started theNFT craze of 2021. But right after, the most attention went to another collection,CryptoKitties. Dapper Labs launched it as a blockchain game on Ethereum to allow players
to purchase, collect, breed, and sell virtual cats. Each of these cats was represented by anNFT. The game's popularity in December 2017 led to dramatic congestion of the Ethereum
network and reached an all-time high in the number of transactions.

fififiFast forward to 2021, the year of the NFT, and there has been a huge explosion and surge
in NFT supply and demand. One of the main factors behind the 2021 boom was the hugechanges that took place in the art market and in the industry in general, when prestigious
auction houses Christie’s and Sotheby’s not only moved their auctions to the online world,
but also began selling NFT art. This led to a record sale of Beeple's Everydays: the First
5,000 days at Christie’s for $69 million. Such a large sale from such a prestigious auction
house greatly strengthened the NFT market.

Founded in February 2021, Yuga Labs emerged as one of the most dominant andnancially successful projects in the NFT ecosystem, and is currently valued at $4 billion.
The company is most known for creating the Bored Ape Yacht Club (BAYC), a collection of
10,000 unique Bored Ape NFTs. In light of this success, in June 2021, Yuga Labs launcheda spinoff collection for Bored Ape holders called Bored Ape Kennel Club (BAKC), and laterin August 2021, the company launched the Mutant Ape Yacht Club (MAYC). The BAKC andMAYC NFTs followed the steps of the BAYC, with both collections quickly starting to sell fortens of thousands of dollars.
After a strong 2021 that brought the company $127 million in net revenue, Yuga started
2022 with a bold move: by acquiring both the popular projects CryptoPunks and Meebits inMarch.
While Yuga Labs has experienced tremendous growth in the NFT market, the company
expanded to the Metaverse and in March, Yuga Labs announced the Otherside, a gami ed
metaverse in which users can turn their NFTs into playable characters.

fifiYuga Labs

Bored Apes Yacht ClubThe Bored Ape Yacht Club (BAYC) is an Ethereum-based NFT collection of 10,000 unique
Bored Apes. Launched in April 2021 by Yuga Labs, each Bored Ape has been generated byan algorithm combining unique features such as expression, clothing, accessories, andmore. It is currently the most expensive NFT collection in the NFT marketplace OpenSea,
with a oor price of 82.07 ETH, approximately $133,000.
The BAYC has become a prime example of tapping into a community feeling to drive thesuccess of a project. Bored Apes double as a Yacht Club membership card and grantaccess to members-only bene ts, such as access to an exclusive Discord server and toTHE BATHROOM, a collaborative graf ti board, merch drops, and bonus NFTs, private
events, and more.
The BAYC has not only captured mainstream attention, but has also been drawing interest
from the world’s most reputable auction houses. In September 2021, Sotheby’s auctioned
101 BAYC NFTs for a staggering $24.4 million. In the same month, Christie’s also sold fourapes, along with NFTs by CryptoPunks, and Meebits, for a combined total of $12 million.
Along with the most reputable auction houses tapping into the BAYC universe, the list of
Bored Ape celebrity owners now runs long. For example, Stephan Curry bought a BoredApe back in August 2021 for $180,000, which he occasionally uses as his Twitter avatar;
Jimmy Fallon purchased the Bored Ape #599 for about $224,000 in early November 2021;
Eminem purchased his Bored Ape in December 2021 for about $452,000; Madonna bought
her Bored Ape for about $466,000 back in March 2022.

Hacks
In its short history, the BAYC collection has been marked by tremendous success, bringing
in considerable amounts of investment. But this success has also drawn negative attention
from blackhat hackers and scammers, resulting in millions of dollars of stolen Bored Apes.

fifi ​​fi

fi

fl

The most notorious cases include the compromise of the of cial Instagram account for theBored Ape Yacht Club in April 2022, resulting in millions of dollars of stolen NFTs. A hacker
posted a phishing link that transferred tokens out of users’ crypto wallets. In June 2022,hackers breached the Discord account of BAYC’s community manager and posted phishinglinks in both the of cial BAYC’s and its metaverse project Otherside's Discord channels.

Our Research
The team at Immune , the leading bug bounty and security services platform for Web3,
which protects over $100 billion in users’ funds, has assessed the volume of BAYC NFTs
stolen and reported suspicious activity on OpenSea.
Overview
We have collected reports of stolen BAYC NFTs and IDs reported for suspicious activity onOpenSea. We have collected a total of 143 BAYC IDs totaling $13,582,962.08 of which 134
are still Reported for suspicious activity on OpenSea, representing a total of$12,638,406.97.
The most valuable Bored Ape currently reported for suspicious activity was last sold for 194
ETH, equivalent to $267,914.
The banner Reported for suspicious activity on OpenSea represents an item that has been
locked, meaning the NFT cannot be bought, sold, or transferred using OpenSea. However,
OpenSea doesn’t have custody of the NFTs on the platform, which provides sellers theopportunity to use other platforms to transfer or sell stolen NFTs, or sell them directly tousers.

fiIn 2021 a Twitter user posted a story on how he exchanged Bored Ape 753 with Ape 9988
using the NFTX liquidity pool. Ape 9988 was stolen earlier and therefore listed as “reportedfor suspicious activity” on OpenSea, making it impossible for the hackers to sell it there. Theuser paid 6.13 ETH for the swap in addition to the price of his own NFT, last listed at 63
ETH. Ape 9988 is no longer locked down on OpenSea and is currently listed at 269.69 ETH.

NFT Security Q&ARecurring hacks, scams, and the possibility of getting your hands on a stolen Bored Ape
without realizing it are just some of the reasons it is increasingly important to understand thesigni cance of NFT security. Immune 's team clari ed some of the most important security
concerns that users should be aware of.
How do I securely store my NFTs?
The best way to store NFTs is in a hardware wallet or cold wallet. You can also use a smart
contract-enabled wallet like Argent.
Storing crypto assets in hot wallets like Metamask, TrustWallet, or other browser-based
wallets makes you more vulnerable to phishing attacks, clipper viruses, or other types ofmalware designed to compromise your system and steal your private keys. Once a hacker
has your private keys, it’s over. They not only have access to your NFTs, but also any othercrypto assets in your wallet.
What are the attack vectors hackers use to steal NFTs?
Phishing, malicious links, malware, viruses, and users being tricked into approving
malicious transactions.
What should I look for and do in order to avoid falling victim to phishing attempts?
Be careful of opening les or clicking links from messages that people send you on Discord,
Telegram, Twitter DMs, and even LinkedIn. If something looks too good to be true, that’s
usually a sign of a trap. Don’t click on any suspicious links from unknown sources, and be
careful which Discord channels you are joining because although they may look legitimate,they may actually be full of scammers.
In some cases, clicking a malicious link is enough for sophisticated hackers to own yourmachine and transfer out NFTs from a browser wallet. In other cases, they may require you
to accept a signed message on MetaMask, which will pop up after you click on a link.

fififififi

Sometimes project-owned Discord, Telegram, or Twitter accounts can be hacked and sendout malicious links or offers. For important announcements, projects usually notify users via
all of their social media accounts, or at least more than one. Make sure to check the
project’s other social media accounts and feel free to ask around via other channels. Also,
be aware of messages that have an urgent call to action. Those types of messages arespeci cally designed to make users put aside all their critical thinking abilities in the hopesof getting a valuable NFT or other assets before time runs out.

NFT Security Q&A
How do blackhats pro t off of stolen NFTs?
There are several ways. First, blackhats do what’s called ‘wash trading’ – they make somany trades of the stolen NFT through different accounts they control that it’s dif cult to tellthat the NFT was stolen in the rst place. This process also has the effect of making it look
like there’s a lot of demand for the NFT, which drives up the price.
Blackhats can also transfer the NFT out of OpenSea and sell it via a decentralized NFT
exchange, such as NFTX, or try to sell it directly to other buyers – this is usually referred toas an OTC (over-the-counter) trade.

What are the key security issues centralized vs decentralized NFT marketplace face?
If it’s a centralized NFT marketplace, then it’s possible that if they get hacked, you gethacked. As the saying goes, not your keys, not your crypto. An attack could also come fromrogue employees or employees who have been compromised by hackers.
With decentralized marketplaces, individual NFT holders are targeted much more via
phishing and malware.

Can I still protect my NFTs if the NFT Marketplace security has been compromised?
What steps can I take if I suspect my account has been compromised?

fifi

fi

Revoke any access from the NFT itself and move the NFT to a secure wallet like a
hardware wallet. If you believe that your machine has been compromised, wipe it andrestore it to a previous state. You can never be too careful.

Below is the full list of comprimised Bored Apes NFTs that have been reported as stolen
or locked for suspicious activity on OpenSea as of Aug 8, 2022.
ApeID
71

Reported
Suspicious
YES

181

88,00

$121,528

5151

Reported
Suspicious
YES

YES

100,00$138,100

5166

YES

1,00

$1,381

290

YES

118,00$162,958

5171

YES

83,80

$115,728

313

YES

106,00$146,386

5351

YES

103,10$142,385

403

YES

1,90

$2,6245373

YES

125,00$172,625

404

YES

69,00

$95,289

5458

YES

107,50$148,458

511

YES

90,00

$124,290

5538

YES

52,69

$72,765

731

YES

37,49

$51,774

5591

YES

0,23

$318

753

YES

50,00

$69,0505778

YES

110,00$151,910

775

YES

78,00

$107,718

5783

YES

122,50$169,173842

YES

105,00$145,005

5816

YES

45,00

$62,145

993

YES

1,00

$1,3815917

6,40$8,8381013

YES

129,00$178,149

5957

YES

38,43

$53,078

96,00$132,576

6095

YES

0,00

$0

YES

74,50

$102,885

90,00$124,290

102,00$140,862

81,30$112,275

1049

Last Sold
Price ETH

Last Sold
Price USD

ApeID

Last Sold
Price ETH

Last Sold
Price USD

0,00

$01100

YES

118,00$162,958

6166

1181

YES

40,07

$55,335

6178

1207

YES

50,00

$69,050

6330

1277

YES

3,20

$4,419

6623

1277

YES

3,20

$4,419

6663

YES

55,01

$75,969

1364

YES

77,00

$106,337

6740

YES

185,00$255,485

1536

YES

194,00$267,914

6778

YES

88,88

$122,743

1553

YES

99,00

$136,719

6778

YES

88,88

$122,743

109,27$150,908

6794

YES

13,73

$18,961

109,00$150,529

6846

YES

126,00$174,006

14,99$20,701

6891

YES

91,00

$125,671

1584
1590YES

1635

YES

1729

YES

87,00

$120,147

7089

YES

88,00

$121,528

1942

YES

46,70

$64,494

7104

YES

75,00

$103,575

1948

YES

8,00

$11,048

7203

YES

47,90

$66,150

1954

YES

111,00$153,291

7203

YES

47,90

$66,150

2068

YES

59,95

$82,791

7354

YES

45,00

$62,145

2083

YES

65,00

$89,765

7380

YES

100,99$139,467

2162

YES

15,99

$22,082

7521

YES

0,61

$842

2163

YES

8,59

$11,863

7533

YES

1,60

$2,210

2311

YES

6,47

$8,935

7594

YES

3,98

$5,496

2476

YES

91,00

$125,671

7683

YES0,03

$40

2491

YES

86,91

$120,023

7798

YES

0,41

$566

2510

YES

47,60

$65,736

7898

YES

86,00

$118,766

2578

YES

105,00$145,005

8005

YES

125,00$172,625

2611

YES

99,00

$136,719

8028

YES

103,70$143,205

2787

YES

95,00

$131,195

8065

YES

120,00$165,720

2892

YES

30,50

$42,121

8079

YES

2,50

$3,453

3037

YES

1,75

$2,410

8166

YES

131,35$181,394

3215

90,00

$124,290

8167

YES

46,70

$64,495

3215

90,00

$124,290

8207

YES

51,00

$70,4313278

YES

102,49$141,539

8214

YES

41,00

$56,621

3329

YES

35,30

$48,749

8239

YES

93,91

$129,690

3376

YES

125,00$172,625

8255

YES

2,00

$2,762

3391

YES

92,00

$127,052

8302

YES

140,00$193,340

3475

YES

98,90

$136,581

8398

106,00$146,386

3569

YES

110,00$151,910

8405

YES

32,50

$44,883

3646

YES

3,13

$4,316

8484

YES

75,00

$103,575

3746

YES

84,80

$117,109

8599

YES

87,73

$121,160

3771

YES

125,00$172,625

8829

YES

71,00

$98,051

3771

YES

125,00$172,625

8858

YES

58,90

$81,334

3787

YES

7,90

$10,9108911

YES

24,88

$34,359

3852

YES

100,00$138,100

8911

YES

24,88

$34,359

4146

YES

82,63

$114,113

8991

YES

8,00

$11,0484233

YES

102,00$140,862

8992

YES

144,32$199,306

4250

YES

100,00$138,100

9038

YES

75,00

$103,575

4329

YES

120,00$165,720

9237

YES

2,30

$3,176

4429

YES

0,45

$621

9266

YES

53,00

$73,193

4547

YES

75,00

$103,575

9416

YES

49,00

$67,669

4688

YES

100,00$138,100

9481

YES

30,00

$41,430

4694

YES

43,57

$60,169

9483

YES

3,70

$5,1104741

YES

43,99$60,750

9546

YES

106,69$147,339

4755

YES

54,89

$75,803

9618

YES

107,00$147,767

4759

YES

90,50

$124,981

9646

YES

114,92$158,705

4802

YES

29,00

$40,049

9672

YES

120,00$165,720

4930

YES

94,00

$129,814

9753

YES

49,00

$67,669

5087

YES

0,27

$373

9818

YES

18,85

$26,032

5149

YES

245,00$338,345

9915

YES

53,00

$73,193

9917

YES

50,00

$69,050

Price Distribution

If you are a researcher, a journalist or otherwiseinterested in this research, youcan get the full data set using the link below.

If you have questions about this study orImmune itself, feel free to reach out to us.

fifipress@immune .com