Elliptic said it has identified at least three people making more than $1 million off of NFTs being sold for a fraction of what they’re worth.
OpenSea is contacting and reimbursing users affected by a loophole that allows people to buy NFTs for a fraction of their true cost and resell it for thousands. On Monday, blockchain security company Elliptic and multiple Twitter users spoke out about the bug. Motherboard was the first to report on the incident. Elliptic said it «identified at least three attackers who have purchased at least eight NFTs for much less than their market value within the past 12 hours.» The issue affects Bored Ape Yacht Club, Mutant Ape Yacht Club, Cool Cats and Cyberkongz NFTs. One user wrote on Twitter that his NFT was bought for about $1,800 worth of the Ethereum cryptocurrency before it was resold for $196,000. «One attacker, going by the pseudonym ‘jpegdegenlove’ today paid a total of $133,000 for seven NFTs — before quickly selling them on for $934,000 in ether. Five hours later this ether was sent through Tornado Cash, a ‘mixing’ service that is used to prevent blockchain tracing of funds. Jpegdegenlove also seems to have partially compensated two of their victims — sending 20 ETH ($45,000) to TBALLER and 13 ETH ($30,000) to Vault327. Another attacker purchased a single Mutant Ape Yacht Club NFT for $10,600, before selling it on five hours later for $34,800,» Elliptic explained. «The exploit appears to originate from the ability to re-list an NFT at a new price, without cancelling the previous listing. Those previous listings are now being used to purchase NFTs at prices specified at some point in the past — which is often well below current market prices.
