Dozens of Pricey NFTs Stolen After BAYC Instagram Hack

The hack resulted in the theft of four Bored Apes and six Mutant Apes, among other digital collectibles

article-image

BORED APE YACHT CLUB NFTS OWNED BY APE DAO VIA ROLLINGSTONE

share

key takeaways

  • The stolen NFTs are estimated to be worth upwards of $10 million, based on the floor price of the hacked digital collectibles
  • BAYC’s co-founder “Garga.eth” said four Bored Apes, six Mutant Apes, three Kennels and other “assorted valuable NFTs” were transferred to the hacker’s address

The Instagram account belonging to NFT project Bored Ape Yacht Club (BAYC) was compromised Monday, paving the way for the theft of more than a dozen individuals’ digital valuables.

In a tweet, BAYC said a hacker posted a fake link to a copycat website, along with a false airdrop. The airdrop prompted users to sign a so-called “safeTransferFrom” transaction, which transferred the NFTs to the hacker’s wallet.

A safeTransferFrom transaction is a function within Ethereum designed to check for the eligible ERC-721 token standard transfer of an NFT (non-fungible token) from the owner to the recipient.

“Immediately upon discovering the hack, we alerted our community, removed links to the compromised IG account from our platforms and attempted to recover the account,” BAYC tweeted.

The account was hacked despite BAYC employing two-factor authentication and following security best practices, it said in a follow-up tweet. BAYC has launched an investigation in an attempt to discover how the hacker gained access.

According to BAYC’s co-founder “Garga.eth,” four Bored Apes, six Mutant Apes, three Kennels and other “assorted valuable NFTs” were transferred to the hacker. Based on the marketplace’s floor price, it is estimated the value of the hack is upwards of $10 million.

According to the project’s OpenSea account, around nine Bored Ape NFTs have been flagged for suspicious activity. Mutant Apes and Kennels have yet to be flagged.

“We will be in contact with the users affected and will post a full post-mortem on the attack when we can,” Garga said. “For now I would like to stress that 2FA was enabled on the account.”


Get the news in your inbox. Explore Blockworks newsletters:

Tags

Decoding crypto and the markets. Daily, with Byron Gilliam.

Upcoming Events

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

recent research

Unlocked by Template (10).png

Research

Innovations on Aptos’ technical design through Raptr, Shardines, and Zaptos approach near-optimal latency and throughput by unlocking 100% utilization of network resources, with the capacity to settle 260k transactions per second with latencies less than 800ms. The original Move language was revamped with the launch of Move 2, supporting more expressivity in smart contract logic and a scalable ability to interact with high volume datasets. The ecosystem has benefitted from strong asset inflows, now hosting over $1.3B in stablecoins, $450M in bridged BTC, and $530M in RWAs. Activity in the Aptos ecosystem has grown notably over the past year, with monthly application revenue reaching ~$835k and monthly DEX volumes growing to over $5B, both at new all time highs.

article-image

Sam Altman sees our future through the World Orb

article-image

Few US politicians are this clearheaded about Bitcoin

article-image

Pump.fun seemed to kick off buybacks on Tuesday according to onchain analysis

article-image

Stablecoins are a new form of money, with an old kind of limit

article-image

Firedancer has yet to go fully live, but its progress has been “pretty impressive,” a dev said

article-image

House lawmakers support, criticize the GENIUS Act, CLARITY Act and the Anti-CBDC Surveillance Act in Monday hearing