Bored Ape Yacht Club Scams: How They Work and How to Avoid Them

The phrase Bored Ape Yacht Club scam covers several different kinds of fraud that target the collection, its holders, and people who want to buy in. Bored Ape Yacht Club, often shortened to BAYC, is a collection of ape-style NFTs on Ethereum created by Yuga Labs. Because the collection has a large, visible community and high-value sales, it has been a frequent target for people who want to take NFTs or money from holders.

The scams fall into a few broad groups. Some take over official social media accounts and use them to promote fake airdrops or mints. Some impersonate founders or staff in direct messages. Some use phishing links that ask for a wallet signature. Others sell lookalike websites or fake marketplace listings. Some pitch the NFTs as a financial investment with guaranteed returns.

The common thread is that the attacker wants you to hand over control of something, either your wallet's approval, your seed phrase, or the payment itself. Once a wallet is drained, NFTs and tokens are usually moved quickly and are hard to recover. Understanding these patterns helps you recognise the next version of the scam, even when the details change.

This guide describes the methods that have been reported, explains the warning signs, and lists practical steps for holders and buyers. It does not provide information on how to carry out any of these attacks.

One of the best-documented cases happened in April 2022, when the collection's Instagram account was compromised. Reports at the time said the attacker used the account to advertise a fake airdrop connected to metaverse land, and that roughly 133 NFTs valued at about $2.4 million were taken from holders who followed the instructions. Coverage from several outlets described the attack as a phishing operation rather than a break into the NFT contracts.

A later incident in 2022 was reported to have cost holders more than $350,000 in Bored Ape and related NFTs through another phishing campaign aimed at the project. These events show a pattern. The attacker does not need to break the blockchain. They need a trusted channel with a large audience, a believable offer, and a link that asks for a signature.

Hijacked accounts are effective because followers assume a post from a familiar name is authentic. A verified badge or a long history of posts does not prove that the person behind a post is the original owner. Compromised accounts can be repurposed quickly, and the first post after a takeover often looks normal.

For holders, the lesson is to treat any unexpected announcement from an official account as unverified until it is confirmed through another route, such as the project's own website typed by hand or a statement from the company behind the collection.

Another common method is impersonation. After an account is hijacked or a look-alike profile is created, scammers contact holders in direct messages, comment threads, or group chats. They may claim to be a founder, a community manager, a moderator, or support staff. Some reports from 2022 described attackers who obtained verified Twitter accounts and rebranded them to present themselves as the founders of the project.

The messages usually follow a script. They offer help with a problem, such as a stuck mint, a bridge issue, a missing airdrop, or a security warning about your wallet. They then ask you to verify your identity, connect your wallet to a site, or share your seed phrase. Some ask you to join a private call or a Discord server, where the pressure builds.

Real teams do not ask for seed phrases or private keys. They also do not normally contact holders first with urgent requests to sign something. If someone claims to be official, check the project's verified channels independently and do not reply through the link or account that contacted you.

If you are a member of a community, it helps to know how staff usually communicate. Ask yourself whether the request is the kind the team would make publicly. If it is only available in private, treat it as suspicious until you have confirmed it through another source.

Fake airdrops, mints, and giveaways are among the most frequent lures. The scammer posts or sends a message promising free tokens, a special NFT, or early access to a sale. The offer often requires you to connect your wallet to a site, sign a message, or approve a transaction to claim the prize. In many cases the signature grants the scammer control over assets in the wallet.

A legitimate airdrop or mint has a clear source. It is announced through verified channels, the claim process is described in detail on the official site, and there is usually no need to sign unrelated messages or transfer funds to receive something free. Be cautious of any offer that requires you to pay a fee to receive a free item, because that is a common pattern.

Time pressure is another warning sign. Phrases such as claim within the hour or the list closes soon are designed to stop you from checking. Slow down and verify the offer through a route you trust before you connect anything.

As a rule, do not click links from direct messages, replies, or comment threads, even if the account looks familiar. Type the official address yourself or use a bookmark you saved earlier. If you are unsure, skip the offer. Missing a real airdrop is usually less costly than losing a wallet.

Approval phishing is one of the most damaging methods because it may not look like a payment at all. Ethereum NFT and token contracts often ask a wallet to grant a third party permission to move assets. A site can request a broad approval, sometimes labelled as a simple sign-in or a verification step. Once the approval is signed, the scammer can transfer the approved assets without asking again.

Some phishing sites ask for a message signature rather than a transaction. The signature may look harmless, but it can authorise actions on your behalf or create a permission that is later used to drain assets. Other sites mimic well-known marketplaces and present a fake listing that leads to a transaction with a malicious contract.

The defence is to read every prompt before you confirm it. Check which contract is being approved, what permissions it grants, and whether the amount is limited or unlimited. If a site asks for permission you do not understand, decline it.

You can also reduce exposure over time by reviewing and revoking old approvals that you no longer need. Several reputable wallet and block explorer tools show your active approvals. Use them carefully, and confirm you are on the official tool before connecting your wallet.

Lookalike websites are built to resemble an official mint page, a marketplace, or a project portal. They may copy logos, colours, and page layouts, and they may use domain names that differ by a single letter or a different top-level domain. Public reporting and paid advertisements can also point to these sites, which makes them harder to spot.

Fake marketplace listings are a related problem. A seller may offer a discounted NFT on a site that looks like a known platform, but the payment goes to the scammer and the item never arrives. In other cases, the site asks you to connect your wallet and then drains it.

A quick check helps. Compare the full web address with the one you have saved from a trusted source. Look for missing or misspelled text, unusual redirects, and requests that appear mid-session. Be wary if a page asks for your seed phrase, which should never be entered on any website.

When buying NFTs, use the marketplace's official site or app, and confirm the collection's contract address against the project's published information. If a deal is only available off-platform, treat it as high risk.

Most Bored Ape scams share recognisable features. Use the list below as a quick check before you click, connect, or sign anything.

• An unexpected message from an account claiming to be staff, a founder, or support
• A giveaway or airdrop that requires you to connect a wallet or sign a message
• Urgent deadlines, countdowns, or threats that your NFT will be lost
• Requests for your seed phrase, private key, or recovery words
• A link in a direct message, reply, or comment that leads to an unfamiliar domain
• An offer that asks you to send funds first to receive a larger reward
• A price far below the recent sales you can see on reputable data sources
• Promises of guaranteed profit or returns from holding or flipping NFTs

If you see any of these, pause. Confirm the claim through the project's verified channels, search for independent reports, and talk to a trusted friend before you act. A scammer relies on speed, so an extra few minutes of checking is often enough to expose the trap.

If you think your wallet has been compromised, act quickly, but do not panic. The first priority is to stop further losses. Move any remaining assets you want to keep to a new wallet that you set up from a fresh seed phrase created on a device you trust. Do not reuse the old seed phrase or any compromised key.

Next, review which contracts your old wallet has approved. Revoke approvals you do not recognise or no longer need, using a reputable approval checker and confirming you are on the official tool. Keep in mind that revoking an approval costs a network fee and does not return assets already moved.

Then record what happened. Save transaction hashes, screenshots of messages, and the addresses of any sites involved. These details help the platforms you use, any relevant law enforcement body, and your own records. Report the phishing site or account to the platform where it appeared.

Finally, consider whether you need professional help. For significant losses, a lawyer familiar with digital assets can explain your options. Recovery of stolen NFTs is often not possible, so focus on preventing repeat losses and limiting exposure from any other wallets or accounts.

Some Bored Ape pitches go beyond phishing and present the NFTs as an investment. A seller might promise steady returns, claim a team will manage value, or describe ownership as a share in future profits. These claims can be misleading, and they have been the subject of legal action.

Several buyers have sued, arguing that the NFTs were sold to them as investments and that they did not understand the terms or risks. The results you may read about describe the claim that buyers invested in what was effectively a pseudo-security without understanding how it worked. The outcome of any case depends on facts, jurisdiction, and the arguments made, and the status of each case changes over time.

For readers, the practical point is that a collectible's price can rise or fall sharply, and past sales do not guarantee future value. Any promise of guaranteed returns is a warning sign. If you are considering a purchase, read the official terms, understand what rights you do and do not receive, and consider whether you can afford to lose the money.

If you are offered an investment deal by someone you met online, verify their identity and their claims through independent sources. Do not rely on screenshots of profits or testimonials, which can be fabricated.

Protecting an NFT wallet is mostly about habits. Keep your seed phrase offline and never type it into a website, app, or chat. Use a dedicated wallet for high-value holdings, separate from the wallet you use for everyday browsing or small transactions. This limits how much can be lost if one approval goes wrong.

Enable every security feature your wallet and social accounts offer. Use a strong, unique password and a multi-factor method that does not depend on a phone number alone where possible. Watch for login alerts and unexpected password reset emails, because they can signal an account takeover in progress.

Bookmark official sites and use them instead of public reporting or links from messages. Before you sign anything, read the prompt and confirm the contract, the permission, and the amount. Review your active approvals periodically and revoke the ones you no longer need.

Finally, stay informed through reliable sources and the project's verified channels, but do not treat any single post as proof. Scams change quickly, so the best defence is a consistent routine of slowing down, verifying, and refusing requests that feel rushed or unusual.