A bug in one of the largest non-fungible-token (NFT) marketplaces allowed hackers to buy US$1mln worth of the digital asset significantly below market value, according to blockchain analytics firm Elliptic.
OpenSea, a popular site for buying and selling NFTs, notched up US$4.8bn worth of sales in January so far, according to Reuters.
However, a glitch allowed hackers to buy NFTs at a previously listed price, before selling at current market value without the owners realising until the transaction was complete.
"The exploit appears to come from the fact that it was previously possible to re-list an NFT at a new price, without cancelling the previous listing," Tom Robinson, chief scientist and co-founder at Elliptic, said to Reuters.
Robinson said they identified eight different NFTs stolen from eight different wallets by three hacker wallets.
He added while crypto wallets are usually held anonymously and would make it difficult to track the hackers down, there is a chance they could be found should they transfer the cryptocurrency into a fiat currency.
His company’s data shows that since 2020 more than US$2bn has been stolen from decentralised finance wallets via hacks.
"It's not common to see marketplace-wide exploits. We do see individual users being hacked and having their NFTs stolen, for example through phishing attacks, but it's not common to see something that affects potentially the entire marketplace," Robinson said.