Bored Ape NFT Hacks: What Happened and What to Do

The reports describe several separate Bored Ape Yacht Club (BAYC) NFT thefts, not one confirmed hack worth more than $3 million. One April 2022 Instagram phishing incident was reported to involve 91 NFTs valued at at least $2.8 million. A separate Discord compromise in June 2022 was reported to involve about 200 ETH, then valued at roughly $360,000. Other reports described additional incidents, including an Instagram hack in December 2022 with losses estimated at $2.5 million.

Those figures refer to different events and should not be combined as if they came from one attack. Values are estimates from the time of each report, not current NFT prices. The available reports also differ in how they describe the affected accounts and losses, so avoid treating every headline as a definitive, complete accounting.

The practical lesson is more useful than the headline: scammers have used trusted BAYC channels and social accounts to put fraudulent links in front of NFT holders. If you own an NFT, a familiar account name or community setting is not proof that a link or transaction is safe.

Several incidents were reported in 2022. The details matter because they were not one continuous attack:

Reported incident	Reported loss or scope	What was described
January 2022	About $2.2 million	A collector alleged that Bored Apes had been stolen; the report also described marketplace restrictions on the NFTs.
April 2022	At least $2.8 million; 91 NFTs	A phishing attack targeting BAYC owners used a compromised Instagram account.
June 2022	About 200 ETH, then roughly $360,000	An attacker compromised the BAYC Discord server and used it to target users.
December 2022	About $2.5 million	A further Instagram account hack was reported.

These are historical estimates and reports, not a live valuation or confirmation that all losses were permanently unrecovered. The January allegation and later account compromises should not be presented as the same event. Nor does a marketplace flag or restriction mean that the NFT was returned: it can affect trading on that service without reversing an on-chain transfer.

In a phishing scam, an attacker tries to make you trust a fake site, message or transaction. A compromised social account can make a fraudulent mint or claim link look credible. A hacked community channel can expose many members to the same lure at once. The link may lead to a page designed to imitate an official promotion or marketplace.

A wallet connection by itself does not always transfer an asset. The danger comes when you sign a transaction or grant an approval that lets a contract or address move tokens. Some malicious transactions are hard to understand from the wallet prompt alone, which is why an unexpected signature request should be treated as a warning.

Before connecting or signing, pause and check:

• Did you navigate to the site independently, rather than follow a direct message or post?
• Does the request match the action you intended to take?
• Is the transaction asking for an approval or permission you do not understand?
• Is the promotion being confirmed through a separate, trusted channel?

If anything is unclear, reject the request. A real NFT or time-limited offer is not worth risking your wallet over.

If you may have signed a malicious transaction, act quickly, but do not rush into a recovery offer from someone who contacts you. Use a device you believe is secure and follow these steps:

1. Stop interacting with the suspicious site. Do not sign another transaction to “cancel” the first one unless you understand exactly what it does.
2. Check the wallet’s activity. Identify unfamiliar transfers and approvals. Save transaction identifiers, wallet addresses, screenshots and relevant messages.
3. Revoke suspicious approvals. Disconnecting a site is not the same as revoking an on-chain permission. Use a trusted wallet feature or independently verified tool, and check the network before approving a revocation transaction.
4. Move unaffected assets. If you suspect the wallet or its recovery phrase is exposed, create a new wallet with a fresh phrase on a secure device and transfer remaining assets. Never reuse the old phrase.
5. Report the incident. Contact the relevant marketplace and community or social platform, and consider reporting it to local law enforcement or a cybercrime reporting service.

Do not pay a stranger who promises guaranteed recovery. A transfer may be irreversible, and recovery scammers often target people who have already lost assets.

A stolen NFT is typically transferred on the blockchain, where the transaction record remains visible. A marketplace or platform may flag the asset or limit trading through its service, as was reported in connection with one theft. That can make an NFT harder to list or buy on that marketplace, but it does not undo the transfer or automatically return control to the prior owner.

If your NFT appears in another wallet, record the receiving address and transaction details. Report the asset through the marketplace’s official support process and ask what actions it can take. Be precise: include the token identifier, the chain, the transaction and the time you noticed the theft. Do not send additional funds to an address claiming to be a support agent.

Keep expectations realistic. Public transaction data can help document what happened, but it does not identify a person by itself. Platform responses and any law-enforcement investigation can vary, and there is no guaranteed recovery route. Be especially cautious of anyone promising to reverse a blockchain transfer, retrieve an NFT for an upfront fee, or asking for your recovery phrase.

The strongest protection is to make each wallet request earn your trust. Keep a valuable NFT wallet separate from wallets you use to test unfamiliar sites or claim promotions. Store its recovery phrase offline, never type it into a webpage, and do not share it with support staff or community moderators.

Use this short checklist before interacting with a BAYC-related offer:

• Verify the channel. A familiar social profile can be compromised; confirm important announcements through another trusted route.
• Check the destination. Do not rely on a link in a direct message, comment or urgent post. Navigate independently and inspect the domain carefully.
• Read the wallet prompt. Reject transactions that do not match the action you chose, especially unexplained approvals.
• Limit exposure. Use a separate wallet for experimental or unfamiliar dapps, and keep only the assets needed for that interaction in it.
• Review permissions periodically. Revoke approvals you no longer need, while checking that the tool and network are correct.

These steps reduce risk, but no wallet setup can guarantee safety. Stay wary of urgency, secret mints, giveaways and claims that you must sign immediately to protect an NFT.

Do not treat a famous collection or community account as proof that a promotion is legitimate. Attackers can copy branding, compromise accounts and imitate official pages. Check a claim through more than one trusted channel, and remember that a verified-looking post can still come from an account that has been taken over.

Avoid these common mistakes:

• Signing first and investigating later. A signature can grant permission even when no NFT appears to be purchased.
• Assuming “connect wallet” is harmless. Connecting is not the same as signing, but it can be the first step in a risky flow. Stop if the next prompt is unexpected.
• Thinking a marketplace flag reverses ownership. Restrictions can limit a listing on one platform; they do not rewrite the blockchain record.
• Sharing a recovery phrase to get help. Anyone with the phrase can control the wallet. Genuine support should not need it.
• Trusting unsolicited recovery services. Do not send crypto or sign transactions based on promises to retrieve a stolen asset.

If you have not lost an NFT, focus on prevention. If you have, preserve evidence, secure any remaining assets and report the incident through official channels. Do not expose yourself to a second loss while trying to fix the first.