Context and open questions
Precedent: how others responded
This page records, with dates and links, how some other projects responded after asset-loss incidents. It presents facts only. A cell reads “not found” when we could not find a source; that does not mean that nothing happened. Incidents differ in mechanism, size and chain, and we draw no conclusion from the comparison.
Closest documented match: Atomicals Market, November 2023
The closest match we found in mechanism is Atomicals Market, a Bitcoin ARC-20 token marketplace. Per the analysis by MetaTrust Labs, its seller signatures used SIGHASH_NONE|ANYONECANPAY instead of SIGHASH_SINGLE|ANYONECANPAY, which allowed listed assets to be taken without paying the seller. Dated facts from the sources:
- 2023-11-21: a post from the market describing the flaw and pausing its markets, as reported by MetaTrust Labs.
- 2023-11-24: a news item reporting the market’s reply to criticism (Coinlive) and one reporting a letter, written by a community member, that said the founder was stepping back and that full compensation was promised (Coinlive).
- 2023-12-02: a market post pledging to airdrop 33,000 ATOM within 48 hours (Coinlive).
- 2023-12-04: a press report that the market said it had airdropped the amount (ChainCatcher). We did not locate the on-chain disbursement transactions.
- 2023-12-15: a market post pledging a further 28,000 ATOM airdrop, a compensation pool funded by 20% of monthly fees, and default compensation of 50% of loss value for future incidents, as reported (ChainCatcher).
Table: incident, time to public notice, compensation
| Incident | Date | Mechanism | Time to public notice (as found) | Compensation (as found) |
|---|---|---|---|---|
| Atomicals Market (ARC-20), first two incidents | 2023-11-14 and 2023-11-23 (dates per the market's Dec 2 post) | Seller signatures used SIGHASH_NONE|ANYONECANPAY instead of SIGHASH_SINGLE|ANYONECANPAY | Market post on 2023-11-21 describing a flaw and pausing markets (as reported by MetaTrust Labs). 7 days after the first stated loss date. | Nov 21-24: market said it would replace lost tokens (reports). Nov 24: a community member reported the founder stepping back and a full-compensation promise. Dec 2: market post pledging to airdrop the 33,000 ATOM within 48 hours. Dec 4: press report that the market said it had airdropped it. We did not locate the on-chain disbursement transactions. |
| Atomicals Market (ARC-20), Nov 25 incident | 2023-11-25 | Same signature type | Not found separately from the above (the Dec 2 post said it was still dealing with it). | Dec 15 2023: market post pledging 28,000 ATOM airdrop within 48 hours, a compensation pool funded by 20% of monthly fees, and a default compensation of 50% of loss value for future incidents (as reported). Disbursement not independently verified. |
| OrdiBots mint (Bitcoin Ordinals) | 2023-11-28 | Mempool sniping of whitelisted users' mint transactions (a different mechanism from a signature flaw) | Reported 2023-11-28 or 2023-11-29 (press) | 2023-11-29: team pledged to airdrop a replacement item to each affected address (as reported). Delivery not verified. |
| OpenSea Wyvern phishing (Ethereum) | 2022-02-19 | Users signed malicious orders after a phishing message (a different mechanism) | Press reports 2022-02-19 to 2022-02-20 | Not found for this incident. Some items were returned by the attacker and three were recovered by another marketplace (press). |
| Bored Ape Yacht Club Instagram compromise (Ethereum) | 2022-04-25 | Official social account compromised and used to post a phishing link (a different mechanism) | Same day, 2022-04-25 (press) | Not found |
| Doginal Dogs Marketplace (Dogecoin) | 2026-10-26 | Seller signatures of type 0x82 (SIGHASH_NONE|ANYONECANPAY); see the technical explainer | As of Oct 28 2026 we did not find an official statement; a pause notice is displayed on the site (status log) | Not found as of Oct 28 2026 |
Reported losses
| Incident | Reported loss |
|---|---|
| Atomicals Market (ARC-20), first two incidents | 33,000 ATOM (per the market's Dec 2 2023 post) |
| Atomicals Market (ARC-20), Nov 25 incident | 23,000 ATOM, plus 5,000 ATOM lost by 5 users in similar incidents (per the market's Dec 15 post) |
| OrdiBots mint (Bitcoin Ordinals) | Not found |
| OpenSea Wyvern phishing (Ethereum) | 254 NFTs from 17 users, about USD 1.7 million (press) |
| Bored Ape Yacht Club Instagram compromise (Ethereum) | About 91 NFTs, about USD 2.8 million (press) |
Sources
- https://www.metatrust.io/blogs/post/the-analysis-of-the-atomicals-market-user-asset-loss
- https://www.coinlive.com/news-flash/337072
- https://www.coinlive.com/news-flash/337405
- https://www.coinlive.com/news-flash/349954
- https://www.chaincatcher.com/article/2107595
- https://www.chaincatcher.com/en/article/2108697
- https://www.theblockbeats.info/en/news/48050
- https://www.influencive.com/mempool-sniping-exploit-plagues-ordibots-mint/
- https://www.theverge.com/2022/2/20/22943228/opensea-phishing-hack-smart-contract-bug-stolen-nft
- https://blockworks.com/news/opensea-scammers-went-phishing-and-caught-over-250-nfts-from-17-users
- https://decrypt.co/93608/mintable-recovers-three-nfts-stolen-from-opensea-users
- https://www.theblock.co/news/web3/2022-04-25-bored-ape-instagram-account-hacked-nfts-worth-2-8-million-stolen-143328
- https://decrypt.co/98614/bored-ape-yacht-club-instagram-hacked-ethereum-nfts-stolen
- https://therecord.media/bored-ape-yacht-club-says-instagram-hacked-nfts-stolen
Data: precedent_incidents.csv. Press reports are secondary sources; where we could not open a primary post we say so. Errors can be reported through the corrections process.