An OpenSea-based front-end vulnerability allowed hackers to steal digital collectibles worth over $1,000,000.

According to leading blockchain security firm PeckShield, the malicious actors made approximately 347 ETH from Ethereum’s largest NFT marketplace, OpenSea. Hackers were able to acquire NFTs that are extremely expensive far below market value by exploiting the bug. He went by “jpegdegenlove” and bought BAYC #8924 at 6.66ETH, which is approximately $14,000. For less than 23 ETH, he also bought #8274 ($50,000. To give you some context, 85 ETH is the current lowest-priced BAYC NFT or approximately $200,000.

The so-called “OpenSea Opportunistic Buyer” also bought two Mutant Apes, a CyberKongz, and a Cool Cats NFT. Elliptic, an analytics firm that uses blockchain to analyze data, reported that there were at least three attackers involved in this exploit. They made more than $1 million.

This exploit seems to be based on the possibility to relist an NFT at new prices without having to cancel the existing listing. Those previous listings are now being used to purchase NFTs at prices specified at some point in the past — which is often well below current market prices.

The suspicious activity that occurred over the weekend was not unusual. However, the bug had been around for several weeks. In fact, it was detected on January 1st.

.@ACYCapital purchased my @BoredApeYC using the @opensea hack that allows a prior listed ape to be sold even once it’s been taken out of a wallet. I’m pleading for this ape to be returned. I’ll pay whatever fees were incurred.

— Carsonᵍᵐ