Digital Asset
Intelligence
Security Incident · ETH Ecosystem

OpenSea Listing mechanism loopholes

·Historical incident record

Incident Overview

An OpenSea user exploited a vulnerability in the non-fungible token (NFT) market to steal hundreds of ether (ETH) from the owners of well-known collectibles such as the Bored Ape Yacht Club (BAYC) and Cyber​​ Kongs of several items. The vulnerability appears to be related to the listing mechanism exploited by the platform and allows users to earn around 347 ETH by purchasing some NFTs at the previous listing price on different markets.

Sources & References

Original incident referencehttps://twitter.com/PeckShieldAlert/status/1485547426467364864 (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Target

    OpenSea

    Attack methodPhishing Attack
    Reported loss$ 3,400,000
  2. Incident date
    Target

    OpenSea

    Attack methodAccount Compromise
    Reported lossNot disclosed
  3. Incident date
    Target

    OpenSea

    Attack methodMalicious Code Injection Attack
    Reported lossNot disclosed
  4. Incident date
    Target

    Mercenary

    Attack methodRug Pull
    Reported loss$ 760,000
  5. Incident date
    Attack methodRug Pull
    Reported loss1,294 ETH