close

Login or Signup

close

Login or Signup

07 Feb 2022
04 mins

OpenSea, the leading NFT market place has reimbursed 750 Ethereum to 130 wallets totaling about $1.8 million, to users who accidentally sold valuable NFTs at well below their market rate through an exploit involving “inactive listings.” 

Recently, several users had complained that their blue-chip NFTs, such as those belonging to the Bored Ape Yacht Club (BAYC) collection, Cool Cats, Mutant Ape Yacht Club, and CyberKong had been purchased at old, cheap listing prices. These listings were never canceled on the blockchain, even though the user interface on OpenSea suggested that they had been turned to “inactive listings”. 

Sellers who wish to cancel their listings on the NFT platform have to send messages over the blockchain by paying transaction or “gas” fees. To avoid paying the gas fees, users transfer the NFT to a secondary wallet and re-transfer it again. This action led to the listing status as in-active on the user interface. 

The feature affected users who had transferred their previously listed NFTs to other wallets without canceling the old listings. Attackers could buy these NFTs at cheap rates by directly interacting with the smart contracts bypassing OpenSea UI and then selling them at much higher current market rates.

According to Fortune, Robert Garcia, 39, a user of OpenSea said he accidentally sold his Mutant Ape NFT for 4.7 Ether (about $11,300). Gracia had transferred his NFT to a separate wallet without canceling the previous listing because he would have had to pay a gas fee, which was over $100 at the time. Garcia said he emailed OpenSea immediately after the unintentional sale, and received a response from them that offered him a refund of 13.8 Ether.

According to the blockchain intelligence firm Elliptic, on January 24, a Bored Ape Yacht Club NFT #9991 was purchased for 0.77 ETH ($1,800) while this family of NFTs currently sell for at least $198,000. Twenty minutes later the hacker sold the NFT for 84.2 ETH ($196,000) – realizing a profit of $194,000. One attacker, going by the pseudonym "jpegdegenlove" paid a total of $133,000 for seven NFTs – before quickly selling them on for $934,000 in ether. Five hours later this ether was sent through Tornado Cash, a "mixing" service that is used to prevent blockchain tracing of funds.

Share this Article

Read Next

Bitcoin is not property - South Korean Supreme Court
Blockchain

Bitcoin is not property - South Korean Supreme Court

The South Korean Supreme Court recently held that no charges of embezzlement or misappropriation can be framed against a South Korean ...

HKMA issues consultation on regulation of stablecoins
Blockchain

HKMA issues consultation on regulation of stablecoins

Hong Kong Monetary Authority (HKMA), the de facto central bank of the city-state has issued a discussion paper on crypto-assets ...

Get latest industry updates directly into your inbox.