World's biggest NFT marketplace exploited, nearly $800,000 stolen

One user has managed to purchase a Bored Ape Yacht Club (BAYC) NFT for tens of thousands less than the price it originally listed for (floor price).

According to a report from Decrypt, Twitter user Tballer announced that he had "lost an ape" and that he began to cry when he had realized what had happened. Tballer's ape sold to "jpegdegenlove" for just 0.77 Ethereum (ETH), which is about $1,700. Additionally, the same buyer also purchased two more BAYC NFTs, one for around $14,000 and another for around $50,800. Notably, the floor price or starting price for a BAYC NFT is 86 ETH, or around $200,000 (at the time this was written).

So, how did this happen? After a group of Twitter users got together on a thread to work out how it was possible that these Bored Apes sold for less than the floor price it was discovered that TBaller, and some other users attempting to sell their NFTs didn't pay the correct amount in Ethereum gas fees to completely de-list their NFT from the marketplace. Instead, these users chose to use OpenSea's "transfer" feature.

2

Decrypt explains that if an NFT holder transfers an NFT from a main wallet to a secondary wallet and then back to the main wallet, it causes the NFT to de-list from the OpenSea marketplace. Notably, this exploit doesn't cancel previous listing on the blockchain. In response to this issue OpenSea have reportedly rolled out a silent update that adds the feature called a "Listings" tab that will allow for users to add and remove active and inactive listings.