Crypto Sleuth ZachXBT Reveals Law Enforcement Detained Wrong Person in $1M Bored Ape NFT Scam

Crypto sleuth ZachXBT has revealed that law enforcement has detained the wrong individual in connection with a 2022 scam that resulted in the theft of over $1 million worth of Bored Ape non-fungible tokens (NFTs). In a May 9 post, ZachXBT identified the wallet behind the scam and linked it to an X account that has since been deleted. However, in 2023, law enforcement detained Sam Curry, a former Yuga Labs security researcher, at an airport as a suspect in the incident. Yuga Labs is the company behind the Bored Ape Yacht Club NFT collection.

ZachXBT expressed disappointment that a security researcher was detained when stronger leads on the actual threat actor were available. The attacker stole 14 Bored Ape NFTs in 2022. According to ZachXBT, law enforcement mistakenly reviewed logs from OpenSea, which included Curry’s home IP address, and used this information to incorrectly link him as the suspect. In reality, Curry had been investigating the theft as part of his security work at Yuga Labs and had used a private key embedded in the website’s JavaScript by the threat actor.

ZachXBT used forensic tracing, including reconstructing the flow of funds through Tornado, an Ethereum mixer, to identify a person he alleges is a likely suspect in the 2022 theft. He recommended that law enforcement officials request all data related to the individual’s social media accounts and investigate on-chain transactions associated with their alleged wallet.

The Bored Ape Yacht Club, launched in 2021, is one of the most valuable NFT collections, with a cumulative market capitalization of over $300 million. As of May 9, Bored Ape NFTs trade for roughly $30,000 each, with individual NFTs varying in price due to unique characteristics. The incident highlights the challenges faced by law enforcement in tracing and apprehending cybercriminals in the decentralized and often anonymous world of cryptocurrency and NFTs.