OAK — OnChain Attack Knowledge

Worked example · 2021-09

Evolved Apes NFT rug pull — Ethereum — 2021-09-24 / 2021-10-05

Loss
approximately $2.7M (~798 ETH at September–October 2021 prices) extracted from the Evolved Apes NFT-mint proceeds on Ethereum. Evolved Apes was a 10,000-supply ERC-721 PFP collection on Ethereum whose first drop sold out in approximately ten minutes on 2021-09-24. The pseudonymous lead operator ("Evil Ape") vanished within days; the project's website was shut down on 2021-10-05 and the project's social channels (Twitter, Discord) went dark across the same window. The promised blockchain fighting game and the artist's payment never materialised.
Recovery
zero on-chain. Recovery operates exclusively through the U.S. criminal-prosecution channel — see Attribution.
OAK Techniques observed
OAK-T12.002 (Fake-Mint / Counterfeit Collection — sub-pattern (a) phishing-mint extended to abandoned-mint variant where the operator deploys a legitimate-on-its-face primary collection, captures mint proceeds, and abandons delivery; this sits inside the broader T12 NFT-rug-pull sub-class flagged for v0.x expansion at the T12 Tactic page) — primary. OAK-T1.003 broadly construed (residual operator authority over project treasury and roadmap delivery; the operators retained full discretionary control over both the mint-proceeds wallet and the roadmap-delivery surface). Downstream T7-class laundering applies (proceeds routed through privacy-mixer / exchange hops post-exit per the U.S. indictment narrative).
Attribution
confirmed. On 2024-06-06 the U.S. Attorney's Office for the Southern District of New York unsealed wire-fraud and money-laundering charges against three UK nationals — Mohamed-Amin Atcha, Mohamed Rilaz Waleedh, and Daood Hassan, all 23 — alleging they orchestrated the Evolved Apes scheme in the fall of 2021. Each count carries a maximum 20-year prison sentence. The case sits alongside the Frosties (DOJ SDNY 2022-03-24) and Mutant Ape Planet (DOJ EDNY 2023-01-05) prosecutions as the v0.1 cohort of confirmed-by-arrest NFT mint-rug cases brought by U.S. federal prosecutors.
Key teaching point
Evolved Apes is the canonical v0.1 example of NFT mint-rug abandonment with delayed (multi-year) federal indictment. The structural failure is identical to Frosties (Solana, 2022-01-09) — pseudonymous operators, no on-chain escrow on mint proceeds, no on-chain binding of roadmap commitments, treasury-wallet outflow within days of mint sell-out, social channels deleted. The case-class lesson is the prosecutorial-latency profile: Evolved Apes' indictment came ~33 months after the rug versus Frosties' ~10-week latency. The longer SDNY-on-UK-nationals investigation timeline reflects the cross-border evidence-collection and extradition-track work that the Frosties (US-resident defendants) case did not require. Defenders writing the recovery-layer documentation for NFT-rug worked examples should treat criminal-prosecution latency as a victim-side outcome variable independent of on-chain forensic clarity — both cases had clear on-chain extraction traces, but the time from rug to indictment differed by ~30 months due to defendant-residency and evidence-collection geometry.

Summary

Evolved Apes was a 10,000-supply ERC-721 NFT collection deployed on Ethereum in September 2021. The marketing surface promised a downstream blockchain fighting game ("Evolved Apes" battle-royale combat using the NFTs as in-game characters) plus charitable-giving allocations from mint proceeds. The first mint drop went live on 2021-09-24 and sold out within approximately ten minutes, generating approximately 798 ETH (~$2.7M at the time) in mint proceeds.

Within days of the sell-out, the pseudonymous lead operator (online handle "Evil Ape") executed the exit. The project's official Twitter account stopped responding; the Discord went silent; the project's website was taken down on 2021-10-05. The artist contracted to produce the NFT artwork was not paid. The promised game development never began. The 798 ETH in mint proceeds was moved out of the project treasury wallet through a chain of intermediate wallets and onward into laundering infrastructure. Holders were left with NFTs whose floor price collapsed effectively to zero in secondary markets.

The case is the third v0.1 anchor in the confirmed-by-arrest US federal NFT-rug-pull cohort, alongside Frosties (/examples/2022-01-frosties.md, Solana, indictment 2022-03-24) and Mutant Ape Planet (Aurélien Michel, EDNY indictment 2023-01-05, conviction 2024). The 2024-06-06 SDNY indictment of Atcha, Waleedh, and Hassan is the prosecutorial closure event; charges include wire fraud and money laundering, with each count carrying a maximum 20-year sentence. The defendants were UK-resident at indictment time; the cross-border evidence-collection and extradition-track work explains the multi-year prosecutorial latency relative to the US-resident Frosties cohort.

For OAK's purposes, Evolved Apes closes the 2021 NFT-rug-pull historical cell that the v0.1 corpus had left empty — the worked-example set jumps from 2021-cohort marketplace-side / phishing-style NFT incidents (LooksRare incentive-wash, OpenSea cohort context) directly to the 2022 cohort (Frosties January, Bored Ape Discord April–June, Premint July, Pixelmon May) without anchoring a 2021-vintage NFT-mint-proceeds rug at all. Evolved Apes is the case that fixes that historical gap.

Timeline (UTC)

When Event OAK ref
2021-09 (pre-event) "Evil Ape" project established; Discord and Twitter set up; roadmap published (10,000 NFT supply, blockchain fighting game, charity allocations); artist contracted (operator setup)
2021-09-24 Evolved Apes mint goes live; sells out in approximately ten minutes; 798 ETH ($2.7M) accumulates in project treasury wallet T12.002 abandoned-mint setup
2021-09-24 / next-day Per indictment narrative, at least $2M of the proceeds moved out of project treasury wallet within one day of first sales T12.002 / T1.003-broad rug-pull execution
Days following 2021-09-24 Project Twitter unresponsive; Discord activity ceases; community detects the rug (operator silence)
2021-10-05 Project website shut down — public confirmation event of the abandonment (project termination)
2021-10 onward Mint proceeds onward-routed through laundering infrastructure (mixer / exchange hops per indictment narrative) T7-class laundering
2021-10 onward Community-organised "Fight Back Apes" follow-on attempt by some affected holders (community-side recovery attempt; out of OAK scope)
2024-06-06 DOJ (SDNY) unseals indictment charging Mohamed-Amin Atcha, Mohamed Rilaz Waleedh, and Daood Hassan with wire fraud and money laundering; FBI-led investigation cited in the press release attribution-confirming public action
2024 onward Cross-border prosecutorial proceedings ongoing at v0.1 cutoff (UK-resident defendants; extradition-track work) (prosecutorial progression)

What defenders observed

  • The on-chain footprint pre-exit was unremarkable. The mint completed cleanly under standard ERC-721 mechanics; the project treasury wallet's holdings were consistent with the publicly-stated mint mechanics; no contract-layer anomaly was detectable in the standard NFT-rug heuristic set. As at Frosties, the pre-exit on-chain signal was effectively zero — the failure is not in the contract, it is in the operators.
  • The exit signal was operator-side and rapid, but staged across days rather than hours. Where Frosties exited in a single same-day window, Evolved Apes' termination was staggered: first the treasury-wallet outflow within one day, then progressive social-channel silence over the following days, then formal website shutdown on 2021-10-05. Defenders running off-chain telemetry on NFT projects (Discord-server activity monitoring, social-account-status monitoring, project-website-availability monitoring) had multiple discrete signals across the 24-hour-to-multi-day window — but the timescale still does not support meaningful protective action for holders who already participated in the mint.
  • The pre-mint due-diligence signal was the only loss-preventing layer. Evolved Apes was launched by a pseudonymous team ("Evil Ape" plus collaborators) with no public identity binding, no escrow contract for mint proceeds, no on-chain delivery commitments, no vesting on roadmap milestones, and no third-party trustee for treasury outflows. The artist-non-payment red flag predated the rug and was visible to anyone who tracked the project's commitment to a known artist contractor, but this signal was not surfaced to mint-pay-window participants. The defender-lesson is identical to Frosties: the risk-disclosure mismatch between roadmap-as-delivery-commitment and operator-structure-with-full-discretion was the load-bearing pre-mint signal and no NFT-mint-platform of the era surfaced this mismatch as a first-class warning to participating buyers.
  • The U.S. criminal-prosecution channel is the recovery layer that on-chain controls did not provide — but with multi-year latency that bounds practical recovery for victims. The Evolved Apes / Atcha-Waleedh-Hassan timeline (rug 2021-09 / 2021-10; indictment 2024-06-06) demonstrates a ~33-month prosecutorial latency for cross-border (UK-resident defendants) NFT-rug investigations. This is a structurally longer recovery-window than the Frosties case (~10-week latency, US-resident defendants) and reflects the additional evidence-collection and extradition-track work required when defendants are non-US-resident. Contributors writing future T12.002-class abandoned-mint cases should treat defendant-residency as a primary variable in the practical-recovery-timeline reconstruction; on-chain-trace clarity is necessary but not sufficient for fast prosecutorial closure.
  • Attribution is confirmed-by-arrest, but attribution is to specific individuals named in the SDNY indictment rather than to a broader actor cluster. Each of the three indicted defendants was UK-resident at indictment time; per the indictment, all three were 23 at the time of charging, having been ~20 at the time of the underlying conduct. The case does not chain into a known broader actor cluster (no OAK-Gnn assignment; no evidence of repeat operator pattern outside the Evolved Apes scheme in the public record at v0.1 cutoff). Contributors writing future NFT-rug-pull worked examples should distinguish between individual-defendant attribution (Frosties, Evolved Apes) and cluster-attributed operator patterns (Mutant Ape Planet operator was linked by ZachXBT to Fashion Ape and Crazy Camels, suggesting cross-project operator continuity that the Evolved Apes record does not show).

What this example tells contributors writing future Technique pages

  • The 2021 NFT-rug-pull historical cell is now anchored. OAK's T12 worked-example set otherwise jumped from 2021-marketplace incidents (LooksRare wash incentives, broader OpenSea cohort) to 2022 NFT incidents (Frosties January, Bored Ape Discord April–June, Premint July). Evolved Apes (September–October 2021) is the missing 2021-vintage anchor for the NFT mint-proceeds abandonment sub-class. Contributors writing 2021-era NFT-cohort framing in future technique pages should reach for Evolved Apes as the canonical 2021 case, paired with Frosties for the 2022-cohort early-anchor.
  • The Frosties / Evolved Apes / Mutant Ape Planet cohort is the v0.1 confirmed-by-arrest US-federal NFT-rug prosecution set. Future T12-class worked examples that are confirmed-by-arrest should cross-reference this cohort for prosecutorial-template framing. The DOJ's wire-fraud-conspiracy + money-laundering-conspiracy charging theory (mint-proceeds-as-wire-fraud-predicate; post-exit-routing-as-money-laundering-predicate) has held across all three cases and is the operative US legal framework for NFT-rug-pull prosecutions through v0.1.
  • Cross-border defendant-residency materially extends prosecutorial latency. The Evolved Apes case (UK-resident defendants, ~33-month latency) versus the Frosties case (US-resident defendants, ~10-week latency) is the cleanest v0.1 paired comparison demonstrating defendant-residency-as-recovery-timeline-variable. Contributors writing the recovery-layer documentation for future T12.002 cases should treat defendant-residency as a first-class variable distinct from on-chain-trace clarity.
  • The pre-mint due-diligence layer remains the only loss-preventing control for this case-class at v0.1. The Mitigations layer for the broader T12 NFT-rug-pull sub-class (currently a v0.x expansion candidate, anchored by Frosties, Evolved Apes, and Mutant Ape Planet) should make explicit that mint-platform-side operator-trust-risk disclosure (escrow status, team-identity-verification status, on-chain-vesting-commitment status, roadmap-binding status, artist-payment-track-record) is the highest-leverage Mitigation — and that OpenSea, Magic Eden, and Blur all lacked such surface-level disclosure at the user-mint-pay moment in 2021–2022. Contributors writing the Mitigations layer should not over-claim the existence of platform-side controls that did not in practice protect participating buyers in any of the three cohort cases.

Public references

  • [dojevolvedapes2024] — DOJ (SDNY) press release / announcement of the unsealing of the Evolved Apes indictment, 2024-06-06; primary attribution source naming Mohamed-Amin Atcha, Mohamed Rilaz Waleedh, and Daood Hassan.
  • [halbornevolvedapes] — Halborn forensic / explainer post-mortem on the Evolved Apes rug pull (timeline, on-chain trace, abandonment pattern).
  • [decryptevolvedapes2024] — Decrypt contemporaneous coverage of the 2024 SDNY indictment, providing public-record corroboration of the charges and the $2.7M figure.
  • [dlnewsevolvedapes2024] — DL News coverage of the 2024 SDNY indictment of the three UK nationals.
  • [viceevolvedapes2021] — Vice / Motherboard contemporaneous October 2021 coverage of the rug pull (Slashdot summary; see DOI / direct-Vice article in citations.bib).
  • [chainalysisnftcounterfeit2022] — Chainalysis NFT-counterfeit and rug-pull cohort framing; supplies cohort-scale context across the 2021–2022 NFT-rug cohort.

Discussion

Evolved Apes is the v0.1 historical-coverage anchor for 2021-vintage NFT mint-proceeds abandonment rugs within the broader T12 sub-class flagged for v0.x expansion. It is structurally identical to Frosties (Solana, 2022-01-09): pseudonymous operators, no on-chain escrow, no on-chain binding of roadmap commitments, treasury-wallet outflow within days of mint sell-out, social channels deleted. The two cases differ only in chain (Ethereum vs Solana), exact loss size (~$2.7M vs ~$1.1M), and prosecutorial-latency profile (~33 months for cross-border defendants vs ~10 weeks for US-resident defendants).

The Evolved Apes / Frosties / Mutant Ape Planet trio is the cleanest v0.1 cohort for confirmed-by-arrest US-federal NFT-rug prosecutions. The DOJ wire-fraud-conspiracy + money-laundering-conspiracy charging theory has held across all three cases. The trio also demonstrates the variation in prosecutorial-latency that contributors should expect: weeks (Frosties, US-resident), months-to-just-over-a-year (Mutant Ape Planet, French defendant arrested at JFK on transit), or multiple years (Evolved Apes, UK-resident defendants requiring full extradition-track investigation).

For OAK's broader credibility, including Evolved Apes in v0.1 closes the 2021 NFT-rug-pull historical cell that the corpus had left empty. The corpus otherwise jumps from 2021-marketplace and 2021-DeFi incidents straight to 2022-cohort NFT incidents; Evolved Apes is the case that puts a 2021-vintage NFT-mint-rug on the timeline and makes the T12 NFT-rug-pull sub-class fully anchored across the 2021–2024 window for confirmed-by-arrest attribution.

The community-organised "Fight Back Apes" follow-on attempt by some affected holders is mentioned here for completeness but is out of OAK's scope as a recovery mechanism — it is a community-side new-issuance project rather than an on-chain-recovery or restitution-channel operation. The recovery layer that operates for Evolved Apes holders is the criminal-prosecution path, on the multi-year timescale that the cross-border indictment imposes.

Techniques demonstrated (2)