Worked example · 2022-04
Bored Ape Yacht Club / Yuga Labs operator-side credential-compromise wave — Ethereum — 2022-04 → 2024-08
Summary
The Bored Ape Yacht Club ecosystem (Yuga Labs flagship collection) was a high-profile target through 2022–2024 because of the floor-price-to-attack-surface ratio: individual BAYC NFTs traded at multi-six-figure floors at peak, holder concentration was discoverable, and the project's credibility rested on a small set of operator-controlled communications channels (the official Discord server, the official Twitter / X account, the BAYC and Yuga Labs Instagram accounts, scheduled mint-announcement cadence). This compounded into a defender problem distinct from per-NFT counterfeit detection: the load-bearing trust layer was the operator's social-media perimeter, and a single compromise of that perimeter could distribute a phishing flow that hundreds or thousands of holders would treat as authoritative.
The cluster of three documented compromise windows from 2022–2024 demonstrates the pattern playing out repeatedly in the BAYC / Yuga ecosystem:
2022-04-25 — BAYC Instagram compromise, Otherside-related phishing. An attacker compromised the BAYC Instagram account (hijacking through a SIM-swap-like or password-reset vector per public reporting; the precise mechanism was not fully disclosed in real time) and posted a phishing link claiming to be an exclusive Otherside (Yuga's metaverse project) airdrop. Followers who clicked through to the linked dApp were prompted to "verify" their wallet, which solicited a setApprovalForAll against the BAYC and Mutant Ape contracts. Estimates of total loss varied with contemporaneous floor pricing; the most widely cited aggregate is in the $2.4M–$3M range across 4 BAYC plus assorted Mutant Apes and other items.
2022-06-04 — BAYC Discord community-manager compromise, "stealth mint" phishing. An attacker compromised a community-manager-level account in the official BAYC Discord server (per Yuga's public statement, via a social-engineering / phishing path against the community manager personally, not via a webhook bug as had been the case in an earlier April 2022 BAYC Discord webhook compromise that distributed scam links but produced limited loss). The compromised account posted a "stealth mint" announcement claiming a surprise drop, with a link to a counterfeit-mint / approval-drainer flow. 32 NFTs were drained across 1 BAYC, 2 Mutant Apes, 5 Otherdeeds, 1 Bored Ape Kennel Club, and additional items, totalling 179.9 ETH (~$360K).
2024-08-22 — BAYC Instagram compromise, fraudulent BAYC-themed mint phishing. An attacker compromised the BAYC Instagram account and posted a phishing link promoting a fraudulent BAYC-themed mint. Multiple high-value NFTs were drained from holders who interacted with the linked dApp; public reports placed aggregate loss at $1.2M+ across the linked drainer flow, with one widely-shared figure of ~$1.4M circulating in the days following.
The on-chain extraction technique is the same across all three windows: the victim signs a setApprovalForAll grant on the relevant NFT contract (BAYC, Mutant Ape, Otherdeed, BAKC) to an attacker-controlled operator address; the attacker (or a downstream drainer service) loops transferFrom calls to drain the approved tokens before the victim notices and revokes the approval. The novelty across the three windows is not in the on-chain extraction — it is at the entry-vector layer: the load-bearing antecedent is operator-side credential compromise of a high-credibility social-media or Discord channel.
For OAK's purposes, the cluster is the canonical worked example for the operator-side social-media-credential compromise sub-class of T11, currently absorbed into T11's parent scope rather than promoted to a dedicated sub-Technique. The cluster also reinforces T4.005's existing positioning as the standard NFT-drainer extraction Technique, and reinforces T12.002's positioning as the counterfeit-mint narrative bait that the compromise channels distribute.
Timeline (UTC)
| When | Event | OAK ref |
|---|---|---|
| 2022-04-01 | Earlier minor BAYC Discord webhook compromise distributes scam links; produces limited loss but is the precursor event in the cluster | T11-broad / T12.002 |
| 2022-04-25 | BAYC Instagram account compromised; phishing post links to fake Otherside-related airdrop | T11-broad antecedent (window 1) |
| 2022-04-25 (within hours) | Holders click through; sign setApprovalForAll grants on BAYC, Mutant Ape contracts; 4 BAYC + multiple other items drained; aggregate ~$2.4M–$3M |
T4.005 extraction (window 1) |
| 2022-04-25 onward | Yuga Labs publishes statement acknowledging Instagram compromise; revokes drainer operator addresses where possible (cannot recall already-transferred tokens) | (operator response) |
| 2022-06-04 | BAYC Discord community-manager account compromised; "stealth mint" announcement posted | T11-broad antecedent (window 2) |
| 2022-06-04 (within hours) | Holders click through; sign setApprovalForAll grants; 32 NFTs drained across 1 BAYC, 2 MAYC, 5 Otherdeeds, 1 BAKC + others; |
T4.005 extraction (window 2) |
| 2022-06-04 onward | Yuga Labs publishes statement; community manager publicly identifies the social-engineering vector | (operator response) |
| 2022-07-17 | Premint platform compromise (separate but contemporaneous T12.002 / T4.005 incident; cross-reference /examples/2022-07-premint-phishing.md) |
(cohort context) |
| 2022 — 2023 | Cohort-level NFT-drainer activity continues; Monkey Drainer active 2022-2023, retired March 2023; Inferno Drainer active 2023-2024 | (cohort context) |
| 2024-08-22 | BAYC Instagram account compromised again; fraudulent BAYC-themed mint phishing post distributed | T11-broad antecedent (window 3) |
| 2024-08-22 (within hours) | Holders click through; sign approvals; multiple high-value items drained; aggregate ~$1.2M+ | T4.005 extraction (window 3) |
| 2024-08-22 onward | Yuga Labs publishes statement; the repeat-Instagram-compromise nature of the incident draws particular criticism in industry coverage | (operator response, repeat-failure framing) |
What defenders observed
- The on-chain extraction was identical across all three windows; the entry vector is what varied. The technical drainer flow in each window was the standard
setApprovalForAll+transferFrom-loop pattern documented at OAK-T4.005. Wallet-side simulation tools (the protective layer at the T4.005 control surface) were already deployed and operational at the holder side by the time of the 2024-08 window. The window-3 loss demonstrates that wallet-layer protection is necessary but not sufficient against this attack class — when holders trust the channel distributing the phishing link, they are likely to override or click-through wallet-side warnings even when those warnings correctly flag the unusual approval. The defender lesson is that trust-layer attacks bypass technical wallet-layer warnings at user-rate-of-error proportional to the channel's credibility. - Yuga Labs' operator-side controls hardened over time but did not close the surface. Public statements after each window acknowledged the operator-side compromise and committed to additional security controls (MFA hardening, role audit on Discord, social-media-account-recovery tightening). The repeat-Instagram-compromise pattern across 2022 and 2024 is the strongest single-operator signal in the cluster that the operator-side social-media perimeter is structurally hard to defend at the level of any single brand: the social-media platforms themselves (Instagram, Discord) are the trust root, and an operator's controls over its own account at those platforms are partial. The within-operator repeat-failure dimension parallels Onyx's repeat-failure on Compound-v2-fork rounding-error (
/examples/2024-09-onyx.md) — different sub-class, same pattern of disclosure-without-comprehensive-remediation. - The cluster is co-temporal with a maturing NFT-drainer-services ecosystem. Monkey Drainer was active through the 2022–early-2023 window with documented BAYC-cohort attribution; Inferno Drainer succeeded Monkey Drainer in 2023–2024 with continued NFT-cohort coverage; Angel Drainer succeeded Inferno Drainer in late 2024. Drainer services are documented in the OAK actor file
/actors/OAK-G02-drainer-services.md. The drainer-service layer is the on-chain operational layer that converts the phishing entry vector into an extracted-asset position, and it is largely fungible across entry vectors — the same drainer infrastructure handled BAYC-cohort phishing flows alongside permit-signature phishing campaigns against fungible-token holders. Defenders monitoring the drainer-service layer (operator-allowlist enrichment from drainer-service-known addresses) get a partial cross-cohort detection benefit; defenders monitoring only the NFT-specific extraction path get less. - Detection latency at the operator side was hours; revocation latency was bounded by individual holder action. Yuga Labs published its statements on each compromise within hours of the event; this terminated the on-going phishing distribution from the compromised channel. But by that point, holders who had already signed
setApprovalForAllhad granted standing authority over their NFTs to the drainer operator, and the revocation window for those holders was bounded by individual action (each holder revoking each per-contract approval). Holders who signed but had not yet been drained sometimes successfully revoked in time; many did not. The asymmetry between the operator-side detection-and-statement window (rapid) and the per-holder revocation window (individual) is structural to the T4.005 drainer pattern and is not changed by faster operator-side detection. - Attribution is pseudonymous and cohort-level; this is the realistic attribution status for the class. No public confirmed-by-arrest tied directly to any of the three Yuga / BAYC compromise windows as of v0.1. Cohort-level attribution to the active drainer-service operators of the relevant period (Monkey Drainer for the 2022 windows, the Inferno Drainer / drainer-graduates cohort for 2024) is the best available characterisation. Contributors should not over-claim attribution simply because the on-chain forensics post-extraction are detailed; the on-chain extraction graph identifies the drainer-service-operator-controlled cluster, but the social-media-account-compromise vector and the attacker-of-record are typically not publicly attributable per-incident.
What this example tells contributors writing future Technique pages
- T11 needs an operator-side social-media-credential-compromise sub-Technique in a future v0.x update. The current T11 sub-Techniques (third-party-signing-vendor compromise, wallet-software-distribution compromise, multisig-contract manipulation) cover the operator-trust-failure surface from a CEX, signing-vendor, and contract-administration angle, but do not have a sub-Technique for the social-media-perimeter compromise that operates as the entry vector for downstream T4.005-class flows. The Yuga / BAYC cluster is the canonical worked example for this gap; the OpenAI / Discord / Twitter compromise patterns documented elsewhere in industry reporting against non-NFT projects (project-X-account-takeover phishing campaigns) are the broader cohort. Contributors proposing T11.NN for "operator-channel credential compromise" should preserve the boundary against T4.005 (the on-chain extraction) and T12.002 (the counterfeit-mint narrative) — T11.NN is the antecedent, T4.005 is the extraction, T12.002 (when applicable) is the narrative bait.
- T4.005 control surface lives at the wallet layer but is overridden by trust-layer attacks. Worked examples that classify exclusively as T4.005 incidents miss the load-bearing entry vector. Contributors writing future T4.005 examples should be explicit about the entry-vector classification — was the approval solicited via a phishing dApp accessed through a search-engine result, a compromised operator channel, a DM from a known account, a malicious WalletConnect session? The entry-vector layer is where the highest-leverage Mitigation lives in many cases, even when the on-chain extraction is identical.
- Cohort-level repeat-failure across operators of the same shape (high-value-NFT-brand social-media compromise) is a defender practice signal. The same shape that recurred at Yuga / BAYC (Instagram and Discord compromise) recurred separately at multiple other major NFT brands across 2022–2024. A v0.x OAK update could include a cohort-level Mitigation entry for NFT-brand operator-channel security baseline — MFA enforcement on social accounts, hardware-key-bound login, Discord role-audit cadence, webhook-creation alerting, out-of-band cross-channel mint-announcement protocols. The Mitigation surface lives at the brand-operator side, not at the wallet-vendor side.
- Drainer-service infrastructure is the cross-cohort connective tissue between NFT-side and fungible-side phishing flows. Worked examples in the corpus that treat NFT phishing as structurally distinct from fungible-token phishing miss the operational-layer commonality. Contributors writing future T4.004 / T4.005 / T11-NN examples should cross-reference the drainer-service actor cluster (
/actors/OAK-G02-drainer-services.md) and treat the drainer-service detection feed as a shared resource across both surfaces.
Public references
[baycdiscord2022]— CoinDesk coverage of the April 2022 BAYC Discord webhook compromise (the precursor event to the June 2022 community-manager compromise).[baycinstagram2022]— Public reporting on the April 25 2022 BAYC Instagram compromise and the Otherside-airdrop phishing flow.[fortunebaycjune2022]— Fortune coverage of the June 4 2022 BAYC Discord community-manager compromise; ~$360K loss across 32 NFTs.[baycinstagram2024]— Public reporting on the August 22 2024 BAYC Instagram repeat-compromise and the BAYC-themed phishing-mint flow.[chainalysisnftcounterfeit2022]— Chainalysis cohort framing for NFT-counterfeit and operator-side-compromise patterns.[chainalysis2022nft]— primary NFT industry retrospective; cohort-scale framing.
Citations
[baycdiscord2022]— April 2022 BAYC Discord webhook compromise; precursor cohort signal.[baycinstagram2022]— April 25 2022 BAYC Instagram compromise; first major Yuga-brand Instagram-vector incident.[fortunebaycjune2022]— June 4 2022 BAYC Discord community-manager compromise; ~$360K loss.[baycinstagram2024]— August 22 2024 BAYC Instagram repeat-compromise; ~$1.2M+ aggregate loss.[chainalysisnftcounterfeit2022]— cohort framing.[chainalysis2022nft]— primary NFT retrospective.
Discussion
The Yuga / BAYC cluster is OAK's canonical worked example for the operator-side social-media-credential compromise antecedent to T4.005 NFT-drainer flows, and is the strongest single-brand evidence for the v0.x case to promote a dedicated T11.NN sub-Technique covering operator-channel credential compromise. The cluster also reinforces a structural observation that the OAK Tactic page for T12 makes explicitly: T4.005 (the NFT-drainer extraction) lives at the wallet-control layer, T12.002 (the counterfeit-mint narrative) lives at the marketplace and verification-badge layer, and a third antecedent layer — the operator-side social-media perimeter — lives at neither and is currently absorbed into T11's parent scope without a dedicated sub-Technique.
The repeat-Instagram-compromise dimension between 2022 and 2024 is the analytically important within-operator signal. Yuga Labs is one of the most security-resourced NFT brands in the ecosystem; the recurrence of the same vector class against the same operator over a multi-year window suggests that the social-media-platform-layer perimeter is structurally hard for any individual operator to fully defend, because the trust root (Instagram's account-recovery flow, Discord's role-and-permission model) is owned by the platform rather than by the operator. The Mitigations layer for any v0.x T11.NN sub-Technique should be explicit about this — operator-side controls (MFA, hardware keys, role audit) are necessary but not sufficient, and the highest-leverage path to closing the residual surface lies at the platform layer (Instagram, Discord) rather than at any individual operator.
The cluster also illustrates a structural observation about the trust-layer-vs-technical-layer asymmetry. Wallet-side simulation tools that flag unusual setApprovalForAll requests were already widely deployed by the 2024-08 window. The window-3 loss demonstrates that when the channel distributing the phishing link is highly credible to the holder, the technical wallet-layer warning is overridden at user-rate-of-error proportional to that credibility. Contributors writing future Mitigation pages for T4.005 should preserve this asymmetry: the wallet-layer control is correct in classification but partial in efficacy when the upstream entry-vector layer is uncontested. The structural defender response is to harden the upstream layer (T11-class controls at the operator), not to tighten the downstream layer (T4.005-class controls at the wallet) further than the user-credibility-override threshold permits.
For OAK's broader credibility, the Yuga / BAYC cluster as a single multi-event worked example is more useful in the corpus than three separate per-event entries would be. The pattern is the cluster, not the per-event detail; the cluster framing makes the operator-side-perimeter Mitigation argument more sharply than any single event would, and gives the v0.x T11.NN sub-Technique proposal a concrete cohort to anchor against.