The peer-to-peer NFT trading platform, NFT Trader, experienced a security breach on December 16, allowing hackers to steal millions of dollars worth of irreplaceable NFTs (Non-Fungible Tokens).
NFT Trader confirmed the incident on X (formerly known as Twitter), stating that the attack targeted old smart contracts and urged users to revoke authorization for two addresses: 0xc310e760778ecbca4c65b6c559874757a4c4ece0 and 0x13d8faF4A690f5AE52E2D2C52938d1167057B9af.
Among the stolen NFTs were at least 13 Mutant Ape Yacht Club and 37 Bored Ape tokens, as well as NFTs from VeeFriends and World of Women, resulting in a loss of nearly $3 million, according to Revoke.cash.
Following the hack, there were rumors and misinformation circulating on social media platforms. Additionally, it remains unclear how many hackers exploited this security vulnerability. In a public message, one of the attackers claimed to have initially exploited it for another user, stating, “I came here to sweep the leftovers.” They demanded a ransom payment in Ether (ETH) equivalent to 10% as a reward for returning the NFTs.
“At first, as usual, I came here to sweep the leftovers. Initially, I thought I could only get TOKEN, but in the end, I found out that I could also get NFTs. […] I am a good person, the value of these NFTs is enough for someone to live a free life, but I don’t care about that. I prefer to pick up the leftovers,” one of the attackers said.
The attacker later claimed to have limited technical skills and proposed that victims pay a 10% reward in Ether (ETH) in exchange for their NFTs. “My technical skills are limited, I cannot handle all the affected NFTs at once, and it takes a lot of energy and time. […] If you want your NFTs back, you have to pay me a reward, that’s what I deserve,” they wrote.
In another development, one of the victims reported that the attacker had returned a rare NFT along with 31 ETH, valued at nearly $70,680 at the time of writing. “And now the hacker just sent me 31 ETH? What’s happening in the world? Is this real life?” the victim wrote on X.