Scammers exploit flaws in crypto platforms

A crypto scammer exploited a flaw in OpenSea's system to buy his Bored Ape Yacht Club NFT artwork for significantly less than its worth, said Mr Chris Chapman. PHOTOS: NYTIMES

(NYTIMES) - Mr Chris Chapman used to own one of the most valuable commodities in the crypto world: a unique digital image of a spiky-haired ape dressed in a spacesuit.

He bought the non-fungible token (NFT) last year, as a widely hyped series of digital collectables called the Bored Ape Yacht Club became a phenomenon. In December, he listed his Bored Ape for sale on OpenSea, the largest NFT marketplace, setting the price at about US$1 million (S$1.38 million).

Two months later, OpenSea sent him a notification: the ape had been sold for roughly US$300,000.

A crypto scammer exploited a flaw in OpenSea's system to buy the ape for significantly less than its worth, said Mr Chapman, 35, who runs a construction business in Texas.

Last month, OpenSea offered him about US$30,000 in compensation, he said, which he turned down in hopes of negotiating a larger payout.

He is one of many crypto enthusiasts who have raised questions about OpenSea, an eBay-like site where people can browse millions of NFTs, buy the images and put up their own for sale.

In the last 18 months, OpenSea has become the dominant NFT marketplace and one of the highest-profile crypto start-ups. The company has raised more than US$400 million from investors, valuing it at a staggering US$13.3 billion, and recruited executives from tech giants like Meta and Lyft.

But as OpenSea grew, it has struggled to prevent theft and fraud. The glitch that cost Mr Chapman his ape has led to months of recriminations, forcing the start-up to make more than US$6 million in payouts to NFT traders.

Customers also complain that OpenSea is slow to block the sale of NFTs that were seized by hackers, who can turn a quick profit by flipping the stolen goods. And plagiarised art has proliferated on the site, outraging artists who once viewed NFTs as a financial lifeline. The company is facing at least four lawsuits from traders, and one of its former executives was indicted this month on charges related to insider trading involving NFTs.

OpenSea's troubles are piling up just as demand for NFTs cools amid a crash in cryptocurrency prices. NFT sales have dropped about 90 per cent since September.

There is also competition from newer marketplaces built by established crypto companies like Coinbase.

The company's clashes with users illustrate some of the central tensions of Web3, a utopian vision of a more democratic Internet controlled by regular people rather than giant tech companies. Like many crypto platforms, OpenSea does not collect the names of most of its customers and advertises itself as a "self-serve" gateway to a loosely regulated market.

But users increasingly want the company to act more like a traditional business by compensating fraud victims and cracking down on theft.

OpenSea, which is based in New York, has hired more customer-service staff, with the aim of responding to all complaints within 24 hours. The company freezes listings of stolen NFTs and has a new screening process to prevent plagiarised content from circulating on the platform.

"Like every tech company, there's a period where you're catching up," said Mr Devin Finzer, 31, OpenSea's CEO. "You're trying to do everything you can to accommodate the brand-new users coming into the space."

OpenSea was founded 4½ years ago by Mr Finzer, a Brown University graduate, and Mr Alex Atallah, a former engineer at software firm Palantir. They are now among the world's richest crypto billionaires, according to Forbes.

Their business model is simple. OpenSea takes a 2.5 per cent cut each time an NFT is sold on its platform. Last year, business spiked as NFTs became a cultural sensation and the value of Bitcoin and other cryptocurrencies skyrocketed.

Because OpenSea collects a fee from each NFT sale, some users argue that the company has a financial incentive not to clamp down on the sale of stolen goods.

This year, Mr Robert Armijo, an investor in Nevada, sued OpenSea for failing to stop a hacker who had stolen several of his NFTs from selling one of them on the platform.

In February, Mr Eli Shapira, a former tech executive, clicked on a link that he said gave a hacker access to the digital wallet where he stores his NFTs. The thief sold two of his most valuable NFTs on OpenSea for a total of more than US$100,000.

Within hours, he contacted OpenSea to report the hack. But the company never took action, he said. Since then, he has used public data to track the account that seized his NFTs and has seen the hacker sell other images on OpenSea, possibly from more thefts.

"It's very easy for these hackers to open an account there and immediately trade or sell whatever they've stolen," Mr Shapira said. "All of these guys need to step up security."

Last month, after The New York Times asked OpenSea about the case, the company responded to Mr Shapira and froze any future sales of the stolen NFTs.

Join ST's Telegram channel and get the latest breaking news delivered to you.