OAK — OnChain Attack Knowledge

Worked example · 2022-01

Big Daddy Ape Club NFT rug pull — Solana — 2022-01-11

Loss
9,136 SOL, about $1.3M at the time, sent by would-be collectors to mint the Big Daddy Ape Club (BDAC) NFTs on Solana; no NFTs were delivered [decryptbdac]. The project was billed as 2,222 ape-themed NFTs listed via Solanart [decryptbdac]. Decrypt dates the rug pull to January 11, 2022 [decryptbdac]. No recovery is documented in the cited sources.
OAK Techniques observed
OAK-T1.003 broadly construed as the residual-authority pattern (the operators controlled the wallet receiving the mint proceeds); OAK-T12.x (NFT rug-pull sub-class) as the structural classification of an NFT-mint-proceeds exit; OAK-T5.001 (Hard LP Drain / Rug Pull — all proceeds taken in a single exit, structurally the hard-rug shape).
Attribution
pseudonymous. The project's founder passed an identity check by Civic (see below), but the cited sources do not name an individual; Civic stated it was cooperating with law enforcement [decryptbdac].
Corrected 2026-10-11
removed the invented "Civik" researcher thread, the SDNY civil complaint, the cross-chain/cluster-reuse claims and the "Frosties on Solana the day before" framing (Frosties was an Ethereum NFT project); added the Civic identity-verification angle and the Decrypt-sourced facts.
Key teaching point
Identity verification of a project founder is not a safeguard for buyers' funds. BDAC was announced as "Verified by Civic Pass" on 2021-12-22, covering control of the Twitter handle and domain, ID capture and a 3D face scan of the founder; Civic's CEO said Civic does not endorse projects or perform due diligence beyond identity verification [decryptbdac]. The founder nonetheless took the mint proceeds. Mint buyers had no on-chain constraint on where their SOL went after payment.

Summary

BDAC was a planned 2,222-piece ape-themed NFT collection on Solana, to be listed on Solanart [decryptbdac]. Digital artist Faith Orr reported that the project's Discord was locked a few hours before the mint, and victims said they received no NFTs after paying; the Twitter account, Discord and website then went dark [decryptbdac]. Orr called it an especially brutal move, since most rug pulls at least leave buyers holding NFTs [decryptbdac]. Solanart said it was deleting the collection from its grid, noting that the project had been approved through Civic verification but "decided to scam anyway" [decryptbdac].

Binance reportedly blocked accounts that received some of the funds, per researcher Mert, and said it was investigating without commenting on specific law-enforcement engagements [decryptbdac]. Civic said it was cooperating with law enforcement and was in direct contact with U.S.-based authorities [decryptbdac].

Timeline

When Event
2021-12-22 Civic announces BDAC as "Verified by Civic Pass" [decryptbdac]
2022-01-11 Discord locked hours before mint; buyers send SOL (9,136 SOL total) and receive no NFTs; Twitter, Discord and website go dark [decryptbdac]
After the rug Solanart removes the collection; Binance reportedly blocks accounts that received funds; Civic cooperates with law enforcement [decryptbdac]

What defenders observed

  • Founder identity verification did not constrain the mint proceeds; the signal available to buyers was the absence of any delivery-conditioned release of funds.
  • A locked Discord shortly before a mint is a pre-event warning sign that victims later pointed to [decryptbdac].
  • Marketplace delisting and exchange account blocks happened only after the funds were taken [decryptbdac].

Public references

Techniques demonstrated (3)