Bored Ape Yacht Club NFT Hacks: What Happened and How to Stay Safe

In April 2022, the Bored Ape Yacht Club brand suffered a set of account compromises that led to losses among holders. The most widely reported incident involved the project's Instagram account. Public reports described roughly 91 NFTs stolen, with a value around $3 million, including Bored Apes, Mutant Apes and at least one CloneX token. Investigators and journalists tracked the thefts on-chain, and the figures varied as more details came in.

A second incident hit the project's Discord server, which was reported as briefly compromised. Reports at the time said around 200 ETH in NFTs was taken, worth roughly $359,000 on the day. The project told users not to mint during the period and warned that suspicious links were circulating.

Earlier in 2022, a New York-based collector publicly alleged that part of a Bored Ape collection had been stolen in a separate hacking incident, with the reported value around $2.2 million. That case is useful context because it shows the same pattern: a valuable collection, a trusted channel, and a victim who approved something they should not have.

The key point for readers is that these were not flaws in the Ethereum blockchain itself. The losses came from account takeovers and from people being convinced to authorize transfers. Understanding that difference is the foundation for protecting any NFT holding.

Social media accounts are a common target for attackers because they carry trust. When an official account posts a mint link, a giveaway or a claim page, many followers click without checking. If an attacker controls that account, the posts look genuine.

In the Instagram incident, reports said the attacker used access to the account to publish a phishing scheme. The post pointed holders toward a site designed to collect wallet permissions. Once a victim approved the request, the attacker could move the NFTs that the wallet held.

Several factors make this type of attack effective:

• The account has a large, engaged audience.
• Followers expect frequent announcements about mints and drops.
• Official-looking graphics and captions are easy to copy.
• The request often asks for a routine action, such as connecting a wallet.

For holders, the lesson is that a link on a social account is not proof of authenticity. Projects and brands can be compromised, so an official-looking post still needs independent verification before you connect a wallet or sign anything.

Discord servers are central to many NFT communities. They hold announcements, role assignments, support channels and verification flows. That makes them a valuable target. In the reported Discord incident, the compromise allowed a malicious actor to direct community members toward a harmful action.

Discord-based attacks often use a few familiar methods:

• A fake support agent sends a direct message offering help with a wallet issue.
• A fake giveaway or whitelist link asks the user to connect a wallet.
• A compromised admin account posts an urgent notice that sounds official.
• A fake site imitates the project's branding and asks for a signature.

The risk rises when members are used to clicking through verification steps. Legitimate projects rarely ask for a seed phrase or private key under any circumstances. Any request for that information is a clear warning sign, regardless of how official the message looks.

If a community channel tells you to avoid minting, pause all wallet activity until you can verify the notice through the project's main official website and verified social accounts.

A common misunderstanding is that a stolen NFT can be reversed by a blockchain. In most cases, that is not true. A blockchain records transfers accurately, and a completed transaction generally cannot be undone by the network. Recovery depends on other factors.

The main routes are:

• Marketplaces or platforms may freeze listings or flag stolen items if they are notified quickly.
• Centralized exchanges may freeze deposits if the stolen assets reach their platform, though this is not guaranteed.
• Investigators may trace the assets and share findings with platforms, which can help with delistings.
• Legal action may be possible in some jurisdictions, though outcomes vary widely.

Speed matters. Thieves often move NFTs quickly through marketplaces or swap them for other assets. Reporting the theft promptly, providing transaction hashes and wallet addresses, and documenting what you approved gives you the best chance of any action.

Be cautious about recovery services that contact victims unprompted. Some scams target people who have already lost assets by promising to recover them for an upfront fee. Legitimate recovery help does not require you to share a seed phrase or sign new transactions to prove ownership.

Phishing is the main method behind most NFT losses of this kind. Many attacks do not need your password or seed phrase. Instead, they ask you to sign a message or approve a contract that grants permissions over your assets.

There are two kinds of requests that matter most:

• Approval requests that let a contract move tokens or NFTs on your behalf, often granted for all items in a collection.
• Signature requests that look harmless but authorize a transfer, a listing or a permit.

Wallet interfaces show the action in different levels of detail. Some display the contract address and the permission scope clearly, while others hide the important details behind a simple button. If the request is for a broad permission, such as access to an entire collection, treat it with extra caution.

A useful habit is to ask what you are approving. Read the function name, the contract address and the scope. If you cannot explain why you are signing, do not sign. You can close the window and check the project's official site through a bookmark you saved yourself.

Most NFT thefts happen after a wallet is connected to a malicious site or after a signature is given. Reducing that exposure is more effective than trying to recognize every scam.

Practical steps include:

• Use a separate wallet for valuable NFTs and keep it apart from wallets you use for daily interactions.
• Store your seed phrase offline on paper or metal, and never in a screenshot, cloud note, email or chat.
• Use a hardware wallet for high-value holdings where your wallet software supports it.
• Bookmark official project websites and type the address yourself instead of following links from messages.
• Turn on account security features, such as two-factor authentication, for your email and any exchange accounts.
• Review token and NFT approvals regularly and revoke any you no longer need.
• Keep your operating system, browser and wallet extensions updated, and remove extensions you do not use.

No single step is enough on its own. Layering these habits makes it harder for an attacker to succeed, even if one defense fails.

If you suspect a drain, speed and order of actions matter. Start by moving quickly, but do not panic into making a second mistake.

A practical sequence looks like this:

1. Stop interacting with the suspicious site or message, and disconnect the wallet from it.
2. Check your transaction history for transfers, sales or approvals you did not authorize, and record each transaction hash.
3. Move any remaining assets to a new wallet that you create on a clean device, with a new seed phrase.
4. Revoke approvals you do not recognize, using a reputable approval-management tool.
5. Secure your email, social accounts and exchange logins with new passwords and two-factor authentication.
6. Report the incident to the platforms where stolen items might appear, and to the official project channels.
7. Keep a written timeline of events, including screenshots and wallet addresses.

Do not send your seed phrase to anyone who offers help, and do not install remote-access software at the request of a stranger. Those requests are common in follow-up scams.

Scammers often copy official branding and then push urgency. Learning the patterns helps you pause before acting.

Warning signs include:

• Messages that arrive unsolicited and claim to come from a project team member or support staff.
• Requests to connect a wallet to a new site to claim a reward, verify ownership or fix an error.
• Requests for a seed phrase, private key or a screenshot of your recovery phrase.
• Pressure to act within minutes, often with threats that your assets will be lost.
• Links that resemble official domains but use small spelling changes or extra words.
• Offers of free mints, airdrops or whitelist spots that appear only through direct messages.

When in doubt, step away from the request. Official projects typically announce mints and rewards through their main channels, and they do not need your seed phrase to verify membership. Taking a few minutes to check protects you from losses that are often impossible to undo.

Public reporting from 2022 and later describes the Bored Ape Yacht Club incidents as past events. The thefts were reported and investigated, and the project responded by warning holders and tightening communication. Reporting around 2024 continued to point back to the April 2022 Discord compromise as a key example of how these attacks unfold. As far as the results show, these were account and phishing incidents rather than failures of the underlying NFT contracts.

Because the market moves constantly, the value of any stolen NFT today will differ from the value reported at the time. If you need current prices or the current status of specific items, check block explorers for transaction history and marketplace pages for listing status, rather than relying on a figure from a news article.

For general context on how a project's on-chain activity looks over time, you can also review independent analytics tools. Keep in mind that analytics can show patterns, but they do not prove whether a specific transfer was lawful or recoverable.

Whatever the current state of any particular case, the practical takeaway does not change. Verify every mint, reward and support request through official channels you reach yourself, and keep your signing habits tight.

Holding NFTs is a long-term decision that carries security responsibilities. The Bored Ape Yacht Club hacks are a reminder that trusted brands and communities can be targeted, and that the most damaging step is often a signature the holder did not understand.

To reduce your risk over time:

• Treat every unsolicited message as untrusted, even if it appears to come from a known project.
• Schedule a regular review of wallet approvals and connected sites.
• Keep only the assets you need in your active wallet.
• Learn the common scam patterns so you can spot changes in tactics.
• Consider a financial or legal adviser if you hold valuable collections and want a plan for loss events.

The NFT space changes quickly, but the defenses are stable. Good habits about seed phrases, signing and verification protect holders regardless of which project they own or which marketplace they use.