<p class="is-style-lead">NFT Trader is suspected to have been breached after several blue-chip non-fungible tokens (NFTs) were wrongfully transferred.</p> 
<p class="is-style-default">According to an X post by Chinese crypto news reporter Colin Wu, the NFTs were transferred to the address 0x909F2159780e64143CF08f32dBBF56Ed19478fda.&nbsp;</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
   https://twitter.com/dingalingts/status/1735994403422928972 
 </div>
</figure> 
<p>Wu gave an update about the address holder’s on-chain message, denying they hacked the P2P trading platform, and claiming they rescued the <a href="https://crypto.news/trump-releases-new-mug-shot-nft-as-former-presidents-ongoing-legal-issues-mount/" target="_blank" rel="noreferrer noopener">NFTs</a> to return them. </p> 
<p>The holder, who identified themselves as a female “scavenger,” revealed the real hacker’s address as 0x3dc115307c7b79e9ff0afe4c1a0796c22e366a47b47ed2d82194bcd59bb4bd46</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">0x90…8fda sent a message on the chain to deny that he was a hacker. He said that he had rescued these NFT assets and would return them, but required the original holders to pay him a 10% bounty; and the real hacker was 0x3dc. ..bd46. <a href="https://t.co/3cXW7ibmcA" target="_blank">https://t.co/3cXW7ibmcA</a></p>— Wu Blockchain (@WuBlockchain) <a href="https://twitter.com/WuBlockchain/status/1736022826984124473?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">December 16, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>NFT Trader also announced it has suffered an attack on old smart contracts on X (formerly Twitter), asking users to remove delegations via <a href="https://revoke.cash/" target="_blank" rel="noreferrer noopener">Revoke.cash</a> to the following addresses: </p> 
<ul> 
 <li>0xc310e760778ecbca4c65b6c559874757a4c4ece0</li> 
 <li>0x13d8faF4A690f5AE52E2D2C52938d1167057B9af</li> 
</ul> 
<p>The P2P trading platform is fairly unknown by most <a href="https://crypto.news/buterin-nft-collection-surge-ethereum-gas-fees/" target="_blank" rel="noreferrer noopener">NFT traders</a>. its website shows its CEO is John Pak, working together with co-founders Mattia Migliore and an individual who goes by the pseudonym “Bruckzr.”&nbsp;</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
   https://twitter.com/NftTrader/status/1736015091563438475 
 </div>
</figure> 
<p>On X, an NFT collector (@dingalingts) urged traders to “revoke approval to their contract ASAP” if they’ve used NFT Trader before. They identified all the stolen digital assets, which amounted to more than $2 million, including 37 BAYC, 13 MAYC, 4 World of Women, and 6 VeeFriends.&nbsp;</p> 
<p> You might also like: <a href="https://crypto.news/bayc-nft-floor-price-drops-90-from-600000-in-18-months/"> US court sides with Yuga Labs, agrees RC BAYC are copycats </a> </p> 
<figure class="wp-block-image">
 <img decoding="async" src="https://lh7-us.googleusercontent.com/LQcLTsbTi9uallr5qGUIb7t5pwyvyGVbKftAjyarud1CvfoMB14LHRzrzgRyvEDpEiQr-zU3ERx8FgXiCPluVL33a69WQ1Undi0Df1vt3EsC3IqQwYE8a-q8FOOatOMCo1ii0oCyCk5RrgCo7okbSss" alt="P2P platform NFT Trader breached, asks users to revoke approval - 33">
</figure> 
<p>For the hacker to return the NFTs, they sent some demands through their on-chain message, insisting owners need to pay them a bounty because “it is what they deserve,” asking for 10% of the NFTs’ values for their “work.”</p> 
<figure class="wp-block-image">
 <img decoding="async" src="https://lh7-us.googleusercontent.com/BEqh8DE1CGBMPecm1OGFLZI2vOFWfWLpytlVfcUgYq3aLvP2tf8Otcj5tNmfmRGWgZuaAMcBebyTmfuk5LMda87lzyh_Z46VSc5Aah5b1-WBF2tsVKRmcSCFr3JOF1UV6qp03zbCnO9EoYJu-1DnhxA" alt="P2P platform NFT Trader breached, asks users to revoke approval - 34">
</figure> 
<h2 class="wp-block-heading" id="strong-don-t-blindly-send-eth-strong"><strong>Don’t ‘blindly send ETH</strong>‘</h2> 
<p>The crypto community is skeptical about the demands. Market analysts like <a href="https://twitter.com/zachxbt/status/1736031844687077462" target="_blank" rel="noreferrer noopener">ZachXBT</a> are warning traders not to “blindly send their <a href="https://crypto.news/price/ethereum/" data-type="link" data-id="https://crypto.news/price/ethereum/">ETH</a>.” </p> 
<p>ZachXBT exchanged some words with the exploiter, questioning the integrity of their word to return the assets. </p> 
<p>The analyst reckoned that if they were up to giving back the stolen assets, they should consider listing the Apes to the original wallet address or using a middleman for the process.&nbsp;</p> 
<div class="wp-block-group is-layout-constrained wp-block-group-is-layout-constrained"> 
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
  <div class="wp-block-embed__wrapper">
    https://twitter.com/basedkarbon/status/1736035493333078292 
  </div>
 </figure> 
 <p>Esports platform Kungama founder Michael Padilla, famously known as TFG, was among the victims of the NFT Trade exploit. </p> 
 <p>TFG took to X to announce he has lost two of his most valued BAYC NFTs, revealing he used NFT trade about 1 and a half years ago and didn’t think he was at risk because he “removed it as a connected site.” </p> 
 <p>TFG acknowledged he didn’t take the necessary steps to shield his assets from the exploit, including revoking permissions on Etherscan.</p> 
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
  <div class="wp-block-embed__wrapper">
    https://twitter.com/TFGmykL/status/1736042905674940759 
  </div>
 </figure> 
 <p>According to Eden Block VC founder, who goes by the handle <a href="https://twitter.com/lior_eth" target="_blank" rel="noreferrer noopener">Lior.Eth</a> on X, this is not the first time NFT Trader has been hacked, although there haven’t been any other incidents reported by the platform prior to today’s hack.&nbsp;&nbsp;</p> 
 <p>An X user dubbed <a href="https://twitter.com/bytes032" target="_blank" rel="noopener">bytes032.xyz</a>, who describes themselves as a white glove smart contract security service provider, described the hack as “peak degeneracy.” </p> 
 <p>They shared a javascript report of NFTTrader’s exploited smart contract, which showcased how everyone was helpless in pausing the contract because the platform’s team didn’t expose the _pause function with public visibility.</p> 
 <figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
  <div class="wp-block-embed__wrapper"> 
   <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
    <p lang="en" dir="ltr">– NFTTrader getting hacked<br>– contract is pausable so they can pause if getting hacked<br>– team cannot pause the contract because they forgot to expose the _pause function with a public visibility<br><br>this is peak degeneracy <a href="https://t.co/Q2SvTXcSEJ" target="_blank">pic.twitter.com/Q2SvTXcSEJ</a></p>— @bytes032.xyz (@bytes032) <a href="https://twitter.com/bytes032/status/1736065591536935366?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">December 16, 2023</a>
   </blockquote>
   <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
  </div>
 </figure> 
 <p>The _pause function is used in a smart contract to halt all activity if something goes wrong. If the _pause function is not public, then only the original creator can stop the contract and prevent further loss of funds. </p> 
 <p>However, if the original creator is unaware of the problem or not available at the time, the hacker could potentially drain all the funds before anyone can stop them.</p> 
</div> 
<p>Nonetheless, there could be a light among the dark clouds seen by the victims of the NFT Trader hack, as BAYC’s founder Greg Solano has offered to pay 10% of the bounty the exploiter has asked for to see the NFTs have been returned to their rightful owners.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">And if the info below is real, I will gladly put up the ETH to see these 50 apes back to their rightful owners. <a href="https://t.co/7jBwQHQRCj" target="_blank">https://t.co/7jBwQHQRCj</a></p>— Garga.eth (Greg Solano) (@CryptoGarga) <a href="https://twitter.com/CryptoGarga/status/1736030630364819693?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">December 16, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<h2 class="wp-block-heading" id="strong-hacker-returns-one-nft-without-bounty-strong"><strong>Hacker returns one NFT without bounty</strong></h2> 
<p>In a remarkable twist, the exploiter has willingly given back a World of Women (WOW) NFT without charge, per <a href="https://etherscan.io/tx/0xac5a2c3a7a330ef2b45bc278a00ea588f798cbab5ccde0d9e42a50368b681756" target="_blank" rel="noreferrer noopener">Etherscan data</a>. After returning the stolen WOW NFT, the hacker also <a href="https://etherscan.io/tx/0xb0597d72723b4b8a81dc6411a8a6435792946bb21625d5cc64a8128b6d73480e" target="_blank" rel="noreferrer noopener">returned</a> a BAYC and a VFT to its rightful owners, without any further demand for payment.&nbsp;</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">Two more apes sent home to from the <a href="https://twitter.com/NftTrader?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">@NftTrader</a> exploiter. <a href="https://t.co/M5GdhEoHUl" target="_blank">pic.twitter.com/M5GdhEoHUl</a></p>— Xeer (@Xeer) <a href="https://twitter.com/Xeer/status/1736039781065425348?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">December 16, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>This unexpected twist has added a sense of unpredictability to the ongoing saga, leaving the community both astonished and uncertain about the hacker’s motives.</p> 
<p> Read more: <a href="https://crypto.news/us-court-sides-with-yuga-labs-agrees-rc-bayc-are-copycats/"> BAYC NFT floor price drops 90% from $600,000 in 18 months </a> </p>

P2P platform NFT Trader breached, asks users to revoke approval

Table of Contents

crypto.news

Other articles published on Dec 16, 2023

Shiba Inu Team Member Addresses Questions Of When Massive $1.2 Million In SHIB Will Be Burned

2023 Sees Ripple Embrace CBDCs and XRPL Developer Growth

Grayscale Explains Spot Bitcoin ETF Tax Structure; What This Means

Grayscale CEO Maintains Optimistic Stance on Spot Bitcoin ETFs!

More brands will be using web3 to capture market share in 2024 | Opinion

Polygon Labs Shift Focus to Prioritize CDK Expansion

Join our free newsletter for daily crypto updates!