OpenSea's listing system contained a bug where transferred NFTs remained listed on the marketplace via the API despite appearing delisted. Attackers exploited this to purchase previously thought-delisted NFTs at old, far below-market prices and immediately resold them for profit. Three attackers collectively extracted over $1M by buying popular NFTs like Bored Ape Yacht Club at historical listing prices.

An OpenSea user exploited a vulnerability in the non-fungible token (NFT) market to steal hundreds of ether (ETH) from the owners of well-known collectibles such as the Bored Ape Yacht Club (BAYC) and Cyber​​ Kongs of several items. The vulnerability appears to be related to the listing mechanism exploited by the platform and allows users to earn around 347 ETH by purchasing some NFTs at the previous listing price on different markets.