The Instagram account of the Bored Ape Yacht Club NFT project was hacked on Monday, it announced via Twitter, reportedly resulting in millions of dollars worth of NFTs being stolen.
The project said in a tweet that "There is no mint going on today," warning users to "not mint anything, click links, or link your wallet to anything." Vice reported that a moderator in the Bored Ape Yacht Club Discord channel posted: "THERE IS A FAKE LAND MINT WEBSITE BEING SHARED BY THE BAYC IG. DO NOT MINT ANYTHING."
The incident exposed the ongoing vulnerability of social media channels operated by crypto ventures, which can put users at risk even if the underlying blockchain technology is secure. The Bored Ape Yacht Club NFT collection is managed by Yuga Labs, which is rolling up a number of other valuable NFT collections and planning further blockchain and metaverse initiatives around them.
CoinDesk reported that the hackers announced a fake airdrop, or distribution of NFTs, encouraging users to click a fraudulent link which would give the hackers control of their wallets. The fraudulent link, which looked like the Bored Ape Yacht Club website, reportedly claimed users could mint "land" in upcoming Web3 project OthersideMeta. According to Vice, NFTs from Yuga Labs, including Bored Ape, Mutant Ape and Kennel Club NFTs, worth a total value of $2.7 million, were stolen in the hack. On Etherscan, the hacker's wallet has been flagged as being part of a phishing scam.
It's currently unknown how the hackers got into the Bored Ape Yacht Club Instagram account. A Yuga Labs spokesperson told Vice that it had removed all links to Instagram from its services, alerted the community and has attempted to recover the account just before 10 a.m. ET this morning.
“Two-factor authentication was enabled and the security practices surrounding the IG account were tight," the spokesperson told Vice. "Yuga Labs and Instagram are currently investigating how the hacker was able to gain access to the account. We’re still investigating."