Open Books
Episode 004 · NFTs

He Stole $5.7 Million in One Night, Then Got Thanked

A Yuga Labs executive took 23,155 NFTs out of strangers' wallets to save them from thieves exploiting the old permissions of a closed marketplace.

By Open Books · 10 minute read Watch the film Listen
A man sits at a desk facing three monitors in a quiet office as the first light of morning reaches the blind
Prefer to listen?Or follow on Spotify · Amazon Music

23,000 NFTs in one wallet

By the morning of 25 September 2026, one man was holding more than 23,000 NFTs that belonged to other people. He had taken them all in a single night.1 Three days later, most of them were still sitting in his wallet. The owners had not come to collect them.2

Two of the NFTs he was holding were Bored Apes, and they belonged to a crew member on an emergency medical helicopter. The crewman who owned them posts on X as SaylorEnergy.3 A Bored Ape is a cartoon ape, one of 10,000, each with its own mix of fur, clothes and expression.4 SaylorEnergy had come home from a night shift and gone to bed. Both Apes were gone by the time he woke up.3 He wrote to the man who had taken them: “Please help. I feel sick.”5

A post on X from SaylorEnergy saying number 511 and 5707 were stolen and asking for help
SaylorEnergy wrote to Quit after waking to find both of his Apes gone.

At 2:31am, a trader who posts as CirrusNFT had been watching one wallet. The wallet was taking NFTs out of hundreds of other collectors’ wallets. Every one of those transfers went through at a price of zero. Cirrus counted 3,832 of them.6 Cirrus warned anyone holding something valuable in a crypto wallet to cancel its permissions.6

Sixteen minutes later, the wallet’s owner replied: “this is a whitehat.”7 A whitehat is a hacker on the side of the people being hacked.1 The wallet belonged to a senior executive at Yuga Labs, the company behind the Bored Ape Yacht Club.8 The executive posts as 0xQuit, and goes by Quit.

Thieves had found a flaw in a system for trading NFTs. Quit was using the flaw first, to move other people’s NFTs somewhere safe before the thieves could reach them.1

In May 2022, the cheapest Bored Ape on sale cost about $420,000. By September 2026, the cheapest Bored Ape cost about $17,000.9

Bar chart: the cheapest Bored Ape cost about $420,000 in May 2022 and about $17,000 in September 2026
The cheapest Bored Ape cost about $420,000 in May 2022 and about $17,000 in September 2026.

The cheapest Ape had lost about 96 per cent of its value before any thief arrived.9 They came four years after the money had left.

Twelve hours of silence

The thieves had struck once already, at 9am New York time on the morning of 24 September.10 One collector’s wallet lost 305 NFTs in three transactions, each at a price of zero.10 The haul included ten Meebits, 3D characters from the studio behind CryptoPunks.11 The thief also took 50 Otherdeeds, plots of land in the Bored Apes’ virtual world.11 According to the blockchain analysts at Bitquery, the thief sold the lot almost at once, for about $25,000.12

By Quit’s own account, more than 12 hours passed before anyone told him.1 The thief had been paid long before Quit knew there was anything to stop.

A post from Quit saying it was over 12 hours before somebody reported the theft to him
Quit wrote that it was over 12 hours before anyone reported the first theft to him.

A spare key that never expired

The big NFT shops had been closing since 2024. Coinbase switched off its own NFT marketplace in 2024.13 Magic Eden started in 2021 as a shop for NFTs on the Solana blockchain, and grew until it was valued at $1.6 billion.14 In March 2026, Magic Eden closed its Ethereum marketplace to concentrate on Solana and on an online casino.15 The permissions Magic Eden’s Ethereum customers had signed stayed exactly where they were.16

A hand holds a mug beside a laptop whose screen shows a list of switches all left on
The permissions Magic Eden's customers had signed stayed switched on after the marketplace closed.

In February 2024, Magic Eden announced that its Ethereum marketplace would run on Payment Processor, a system built by a company called Limit Break. “We’re thrilled to announce,” Magic Eden’s post began.17 Limit Break had built Payment Processor in 2023 to make sure creators were paid a royalty every time one of their NFTs was resold.18

A post from Magic Eden in February 2024 announcing that its Ethereum marketplace will use Payment Processor
Magic Eden announced in February 2024 that its Ethereum marketplace would run on Limit Break's Payment Processor.

A collector who wanted to sell an NFT on Magic Eden first had to give Payment Processor a permission. The permission let Payment Processor move an NFT out of the collector’s wallet whenever a sale went through. Signing it once covered every NFT the collector held from that collection. The permission had no expiry date.16

Picture an estate agent who holds one key that opens every house you own on a street. A listing tells the agent what to ask for a house, and the key lets him hand it over once a buyer has paid. Taking a house off the market cancels the listing, and the agent keeps the key.19 An owner could ask for that key back at any time, by cancelling the permission.20

A woman in a suit holds a ring of keys beside a long street of terraced houses
One signature gave the agent a key to every house the owner held on the street.

Magic Eden stopped using Payment Processor in October 2024, and the permissions its customers had signed stayed live.21 When Magic Eden closed its Ethereum marketplace, the company’s help page told customers that for their listings and bids, “No action is required.”22 The permissions lived on the blockchain itself, and Magic Eden’s shutdown guidance did not mention them.19

A card quoting Magic Eden's help centre, which says no action is required
Magic Eden's help centre told customers that no action was required for their listings and bids.

In September 2026, thieves found a flaw that let them pose as the owner of any wallet that had signed one of those permissions.23 In the estate agent’s terms, a stranger could ring the office, say he was the owner, and have the house handed over for nothing.

A woman on the phone reaches for a key on a board while a stranger waits at the office door
In the estate agent's terms, a stranger could ring the office and claim to be the owner.

The system Magic Eden’s customers had signed for had no off switch. Its code sat on the blockchain, where nobody could change it, Limit Break included.24 The only way to protect an NFT was to get it out of the wallet before the thieves did.1

To save them, take them first

In December 2023, thieves exploited old permissions on a site called NFT Trader, and Quit used the same flaw to get the NFTs back.25 That time the company had to agree to it, and by his own account NFT Trader was “wary of handing over control to an internet stranger.”26 In September 2026 there was nobody to persuade.

A post from Quit in December 2023 saying NFTTrader was wary of handing control to an internet stranger
In December 2023 NFT Trader was wary of handing control to an internet stranger, Quit wrote.

Quit and three helpers began sweeping NFTs out of exposed wallets and into a rescue wallet of his own, using the thieves’ own trick.1 At 1:46am, a single transaction moved 16 Bored Apes into Quit’s rescue wallet.27 That transaction went through at a price of zero, exactly like the thieves’.

A hooded figure's hands on a keyboard beside a screen showing a grid of sixteen tiles
At 1:46am one transaction moved 16 Bored Apes into the rescue wallet at a price of zero.

For the next hour Quit said nothing in public.28 To Cirrus, and to everyone else watching, the rescue looked exactly like a robbery. The silence ended at 2:47am, when Quit answered the man who had been watching him.7 At 3:16am, Yuga Labs’ chief executive, Michael Figge, told his followers that “Quit is in the pocket.”29 Just after 4am, Quit posted the addresses of the flawed contracts and told collectors to cancel their permissions as soon as possible.20

A post from Yuga Labs chief executive Michael Figge saying Quit is in the pocket
Yuga Labs' chief executive told his followers at 3:16am that Quit was in the pocket.

$1.7 million he wasn’t fast enough for

At 4:25am, a second attack began.30 Collectors who bid on NFTs kept a version of Ethereum called wrapped eth in their wallets. Those bidders had given Payment Processor permission to spend that money when a sale went through. The flaw let a thief sell a worthless NFT into a bidder’s wallet and walk off with the bidding money.23 In the estate agent’s terms, a stranger could spend the money you had left with the agent, on a house you would never have bought.

The opening transaction of the second attack emptied 25 wallets at once.30 A collector who posts as allodev lost about $16,000.31 Another collector wrote: “I got hit for everything.”32

A post from a collector reading I got hit for everything
Another collector wrote that he had been hit for everything.

Just after 5am, Quit posted his account of the night. “All in all, we rescued 23,155 NFTs worth north of $5.7M USD,” Quit wrote.1 Nine minutes later, Quit posted again: “all I’ll be able to think about is the $1.7M in WETH I wasn’t fast enough for.”33

A post from Quit about the 1.7 million dollars in wrapped eth he was not fast enough to save
Quit's post about the bidding money he could not save became the most liked of his rescue posts.

An independent count by the news site CryptoTicker put the bidding money taken lower than the figure Quit was blaming himself for.34 Of everything Quit wrote about the rescue, the post about the money he could not save got the most likes.33

$100 million in one wallet

Two days after the rescue, about 1,000 of the NFTs nobody had come back for were from collections that had peaked in 2022.35 Among them were Bored Apes and Mutant Apes, the biggest names of 2022. At each collection’s highest price in the spring of 2022, those 1,000 NFTs would have been worth about $100 million.36 In September 2026, the same 1,000 would fetch about $2.6 million.37

Bar chart: about 1,000 unclaimed NFTs worth $100 million at their 2022 peaks and $2.6 million in 2026
The same 1,000 NFTs were worth about $100 million at their 2022 peaks and about $2.6 million in September 2026.

Owning a Bored Ape made the holder a member of a club, with the right to use the picture in business, and in 2021 the celebrities arrived.38 In January 2022, the singer Justin Bieber paid about $1.3 million for a Bored Ape.39 Bieber’s Ape has no rare features, and its seller had paid less than $1,000 for it the spring before.40 CNN later reported that about $2.5 million in Ethereum arrived in Bieber’s wallet from the crypto payments company MoonPay, hours before the purchase.41

A class action that accused Yuga Labs and its celebrity promoters of inflating the Apes’ price was dismissed by a federal judge in October 2025.42 By September 2026, the best offer for Bieber’s Ape was about $17,000, the going rate for any ordinary Ape.43

$300 million of virtual land

On the last day of April 2022, Yuga Labs sold 55,000 plots of land in a virtual world it called Otherside.44 The sale raised about $300 million.45

Bar chart: the Otherside land sale raised $300 million and buyers paid $176 million in network fees
Buyers paid about $176 million in network fees on top of about $300 million for the land.

Across the three-hour sale, buyers spent about $176 million on network fees.46 The fees came to more than half of what the buyers paid for the land itself.47 Yuga apologised “for turning off the lights on Ethereum for a while.”48

In the week of the land sale, Bored Apes, Mutant Apes, Otherdeeds and Meebits all reached their highest prices ever.49

Four NFT characters side by side, including a Bored Ape, a Mutant Ape, an Otherdeed and a Meebit
Bored Apes, Mutant Apes, Otherdeeds and Meebits all reached their highest prices ever in the week of the land sale.

In September 2022, a rapper sold one Otherdeed that came with a rare creature, a Mega Koda, for about $310,000.50 In September 2026, the best offer for that plot of virtual land was about $1,000.51

The $532 million CryptoPunk

Some record prices were never real. In October 2021, the owner of one CryptoPunk borrowed more than half a billion dollars, bought the Punk from their own wallet, and repaid the loan, all inside a single transaction.52 On the public record, the Punk had sold for about $532 million.52 The buyer was the person who already owned it.

Two pairs of hands type on matching laptops with checked screens under one lamp
On the public record, the Punk was sold to the person who already owned it.

By 2026 the crowd that had set all of those prices had thinned out, and the shops that served it had closed.53

“They are me”

The day after the rescue, an anonymous account on X published a seven-part thread questioning whether Quit had set the rescue up in advance.54 The thread listed Quit’s roles across the NFT business: Yuga Labs executive, code auditor, collector, and founder of a trading bot called oSnipe.54 The thread noted that a wallet named after oSnipe had funded the rescue wallet.55

Quit replied that the bot and its wallets were run entirely by him: “They are me.”56 “I’m an open book,” Quit wrote, and he finished the post by saying that he just likes NFTs.56

A post from Quit saying he is an open book and that the bot and its wallets are him
Quit replied that the bot and its wallets were run entirely by him.

In the same reply, Quit said Yuga Labs had built its own internal marketplace on Payment Processor, and that Yuga had not known about the bug either.56 Within a day, the anonymous account conceded that the evidence did not show Quit had set up the rescue in advance.57

“Not blaming, just stating”

Magic Eden’s first statement called Payment Processor “a NFT trading protocol maintained by the company Limit Break”.58 Magic Eden’s statement added: “No live Magic Eden listings were impacted in this exploit.”58 Magic Eden had closed its Ethereum marketplace six months earlier, which left it with no live listings to affect.59 Later that day, replying to another user on X, Magic Eden’s account wrote: “Not blaming, just stating exactly what happened.”60

A post from Magic Eden saying Limit Break's protocol got hacked and it stopped using it two years ago
Magic Eden replied that the protocol was Limit Break's and that it had stopped using it two years earlier.

Limit Break had a newer version of the system with a pause switch, and paused that one quickly once Quit got in touch.61 Limit Break thanked Quit for his “heroic efforts,” then said the old contract was unchangeable “by design,” and added: “That is how web3 works.”61 Limit Break’s statement went on: “Please do not wait for us or anyone else to ‘fix’ this. Go revoke permissions NOW.”61

A post from Limit Break telling owners not to wait for a fix and to revoke permissions now
Limit Break told owners not to wait for a fix and to revoke their permissions now.

Quit said the night had cost him $7,500 in network fees, out of his own pocket.62 Strangers tipped Quit, and someone launched a meme coin in his name.63 Gary Vaynerchuk, who created the VeeFriends NFTs, sent Quit one of them, and told his followers what kind of hero Quit was “when NFT hacks happen.”64

None of the companies involved announced a reward for the rescue.65 Two days after the rescue, Magic Eden’s account on X was promoting its casino.66

A man in a suit leans on an empty reception desk beside a bell and a wilting plant
None of the companies involved announced a reward for the rescue.

One in twelve came home

On the night of the 25th, Quit opened a website where owners could take back their NFTs. An owner had to cancel the old permission first.67 Then Quit’s power went out.68 Quit wrote: “Doesn’t seem like power will be back tonight. Maybe my sign to touch grass.”68

A post from Quit saying power will not be back tonight and it may be a sign to touch grass
Quit lost power on the night the claim site opened and joked that it was a sign to touch grass.

Early on the 26th, SaylorEnergy, the helicopter crewman, wrote to Quit: “My family thanks you. There are real people behind these NFT’s.”69 Later that morning SaylorEnergy was home from another night in the air: “After another busy flying night I had to put these Apes to rest. Now, my family can rest …”70 SaylorEnergy told the Bored Ape Gazette, a fan news site, that Yuga and Quit had rescued “my online identity.”3 On the night the Apes were taken, the pair he got back were worth about $34,000.71

A post from SaylorEnergy telling Quit that real people are behind these NFTs
SaylorEnergy wrote to Quit early on 26 September that real people were behind these NFTs.

By the afternoon of the 26th, about 2,750 NFTs had gone home.72 By 2 October, after more sweeps, more than 200,000 NFTs had been saved.2 About one in twelve had been claimed by their owners, though those were worth more than half of the money the claim site could put a price on.2

Bar chart: owners had claimed 8 per cent of the rescued NFTs but 52 per cent of their priced value
By 2 October owners had claimed about 8 per cent of the rescued NFTs, worth 52 per cent of the priced value.

One onlooker guessed that a quarter of the rescued NFTs had come from “dead and forgotten wallets.”73 Claiming one meant cancelling a permission signed for a shop that had closed, to collect the kind of Ape that was then selling for about $17,000.67

A woman in a white coat hands a bundle to a man under a streetlight outside a shuttered shop
Claiming an NFT meant cancelling the old permission first and then collecting it.

The rest are still waiting in a rescue wallet, kept safe for owners who, four years after the peak, may have stopped checking on them.2

Sources

  1. Quit, thread on X, 25 September 2026: his account of the first theft and the rescue, posted at 5:06am New York time. It includes the 305 stolen NFTs, “It wasn’t until over 12 hours later that somebody reported it to me”, “the only path towards protecting affected assets was to run a whitehat operation”, credit to three helpers (@coffeedev, @0xjustadev and @whiteoakkong), and “All in all, we rescued 23,155 NFTs worth north of $5.7M USD”. The 23,155 count and the $5.7 million value are his own and unaudited. ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7

  2. Claim site counter, nftsaresafu.xyz: on 27 September 2026, 2,431 of 26,448 rescued assets had been claimed (about 9 per cent). On 2 October 2026, at 01:29 UTC, the counter read 208,365 NFTs rescued across all chains, and “17,157 NFTs returned so far, 8.2% of 208,365”, which is 1 in 12.1. Its value view read “$3,790,514 estimated USD value returned, 52.2% of $7,256,928 in priced assets”, with only 16.7 per cent of allocations priced, using NFT and collection bids of 27 September 2026. ↩ ↩2 ↩3 ↩4

  3. Bored Ape Gazette: SaylorEnergy as an emergency medical helicopter crew member who went to bed after a night shift and woke to find his two Apes gone, later reclaiming both from Quit’s rescue through the claim site, and crediting Yuga and Quit with rescuing “my online identity”. These are his own words as reported by the site. ↩ ↩2 ↩3

  4. Etherscan, Bored Ape Yacht Club contract: a supply of 10,000. The traits of each Ape are recorded in its on-chain metadata. ↩

  5. SaylorEnergy on X, 25 September 2026: “I revoked. #511 and #5707 was stolen. Please help. I feel sick.”, posted at 12:47pm New York time. This is his statement, and the two token numbers have not yet been matched to the rescue wallet on-chain. ↩

  6. CirrusNFT on X, 25 September 2026, posted at 2:31am New York time: “I just watched this wallet drain 3832 NFTs from 100s of different wallets” and “May be a good idea to revoke all NFT permissions if you have any valuables in your wallet”. Crypto Times reports 3,832 as the count of zero-ETH transfers on Etherscan. ↩ ↩2

  7. Quit on X, 25 September 2026: “hey ya this is a whitehat and everything in 0x71cF…fe33 is safe”, posted at 06:47:59 UTC, which is 2:47am New York time. Cirrus posted at 06:31:42 UTC, so the gap is 16 minutes 17 seconds. ↩ ↩2

  8. Quit’s profile on X, read on 27 September 2026: “VP Blockchain @yugalabs”. Also The Block, 25 September 2026. ↩

  9. CoinGecko, Bored Ape Yacht Club: a floor price of 153.7 ETH, or $420,430, on 1 May 2022, and 6.36 ETH, or $17,230.87, when read on 27 September 2026. The fall is 1 minus 17,231 divided by 420,430, which is 95.9 per cent. The implied ether price was about $2,735 on the first date and $2,709 on the second, so the whole fall belongs to the NFTs. ↩ ↩2

  10. CryptoTicker, 25 September 2026: the first theft at 13:08 UTC on 24 September, which is 9:08am New York time, with 305 NFTs taken in three transactions at zero ETH. Quit’s thread says “At 9AM EST”. ↩ ↩2

  11. Quit, thread on X: the haul of “10 Meebits, 50 Otherdeeds, 10 WoW, and 235 Desperate Apewives”. Larva Labs, 11 March 2022: Meebits and CryptoPunks both come from Larva Labs. Euronews, reporting Reuters, 1 May 2022: Otherdeeds as plots of land in Otherside. ↩ ↩2

  12. Bitquery, investigation of the two sweeps: the haul sold within 23 minutes for 9.33 ETH. At about $2,700 an ether (CryptoTicker gave $2,702.88), 9.33 times 2,700 is $25,191. The figure is an estimate and the detail was read through a page summary. ↩

  13. Coinbase Help, NFT migration: the NFT marketplace was switched off on 1 August 2024. Binance followed in July 2026, as The Defiant reported. ↩

  14. Blockspace: Magic Eden as a September 2021 Solana start-up that reached a $1.6 billion valuation. ↩

  15. Decrypt, February 2026: the decision to leave Ethereum and Bitcoin to focus on Solana and its casino and sportsbook, Dicey. Magic Eden help centre: EVM support shut down on 9 March 2026. ↩

  16. Decrypt, 25 September 2026 and AirdropAlert: customers who listed on Magic Eden’s Ethereum marketplace in 2024 signed an “approve for all” permission covering the whole collection, which stays active until the owner revokes it. ↩ ↩2

  17. Magic Eden on X, 12 February 2024: “We’re thrilled to announce that our upcoming Ethereum marketplace will be powered by Payment Processor”, a protocol developed by Limit Break. ↩

  18. Limit Break, launch post, 13 June 2023: Payment Processor was built to settle sales and pay creator royalties. ↩

  19. NFT Plazas, on Magic Eden’s shutdown: the guidance told users to back up their wallets and delist, with no instruction to revoke approvals, and delisting removes a listing while leaving the approval in place. The site’s account of the guidance is used here, and Magic Eden’s own notice has not been checked for any mention of permissions. ↩ ↩2

  20. Quit on X, 25 September 2026: “REVOKE APPROVALS TO THESE ASAP”, with the addresses of Payment Processor V2 on Ethereum and V3 on ApeChain and the advice to use revoke.cash, posted at 08:09 UTC, which is 4:09am New York time. ↩ ↩2

  21. Magic Eden on X, 25 September 2026: its statement says Magic Eden adopted Payment Processor V2 in 2024 and stopped using it, in October 2024. ↩

  22. Magic Eden help centre, marketplace updates: “All EVM marketplace listings, bids, and offers on Magic Eden are off-chain”, and “No action is required.” ↩

  23. Revoke.cash, Magic Eden exploit page: “a flaw that lets them act on behalf of any wallet that approved the protocol”, used to take NFTs directly and, by “forcing wallets to buy worthless NFTs”, to drain approved tokens such as WETH. Blockaid’s alert, reported by KuCoin, says the attacker could “impersonate NFT holders and acquire NFTs previously authorized to this contract at zero cost”. ↩ ↩2

  24. Limit Break on X, 25 September 2026: “an immutable contract cannot be updated or patched by anyone”. Quit’s thread says Payment Processor V2 was not pausable. ↩

  25. Cointelegraph, December 2023: thieves exploited old permissions on NFT Trader. Quit on X, 17 December 2023: his account of how he reverse-exploited the NFTs back. ↩

  26. Quit on X, 17 December 2023: “I contacted NFTTrader, but they were (understandably) wary of handing over control to an internet stranger.” In his next post, “After several hours on discord and the phone, they agreed to act on it”. ↩

  27. Transaction 0x16921806…c6c926, block 26,052,469, at 05:46:47 UTC, which is 1:46am New York time: 16 Bored Apes, 3 Art Blocks tokens and 1 Winds of Yawanawa token for 0 ETH, as reported by Crypto Times. The transaction page itself has not yet been checked by hand. ↩

  28. Quit’s first public post was at 06:47:59 UTC, and the transaction was at 05:46:47 UTC, so the gap is 61 minutes. See Quit on X. ↩

  29. Michael Figge on X, 25 September 2026: “exploit discovered a few hrs ago, Quit is in the pocket rn white hat rescue of affected assets”, posted at 07:16:14 UTC, which is 3:16am New York time. ↩

  30. CryptoTicker, 25 September 2026: the drain of wrapped eth began at 08:25 UTC, which is 4:25am New York time, and the first transaction took 281.66 WETH from 25 wallets. ↩ ↩2

  31. allodev on X, 26 September 2026: “My 5.94 WETH got drained”. At $2,703 an ether, 5.94 times 2,703 is $16,056. ↩

  32. Authenticecigs on X, 26 September 2026: “I got hit for everything”. ↩

  33. Quit on X, 25 September 2026: “worked through the entire night to save ~$6M worth of NFTs and all I’ll be able to think about is the $1.7M in WETH I wasn’t fast enough for.”, posted at 09:15:26 UTC, which is 5:15am New York time and 9 minutes 26 seconds after his thread at 09:06:00 UTC. On 27 September the post showed about 5,500 likes, the highest of his posts about the incident that were captured. ↩ ↩2

  34. CryptoTicker: 530.7 WETH taken from 911 wallets on Ethereum, as of 25 September at 12:22 UTC. At $2,702.88 an ether, 530.7 times 2,702.88 is about $1.43 million, against Quit’s figure of $1.7 million. ↩

  35. Etherscan, rescue wallet 0x71cF…7fe33, read on 27 September 2026: BAYC 94, MAYC 278, Bored Ape Kennel Club 151, Otherdeed 204, Meebits 89, Azuki 66, Doodles 23, CloneX 91 and World of Women 15, which total 1,011. This is an estimate, read through a page summary, and it covers Ethereum only. ↩

  36. Estimate: the count of each collection in the rescue wallet times its all-time-high floor on CoinGecko, which comes to $98.8 million (34,028 ETH). It adds up best days that were never held at one moment, and floor times count overstates what could have been sold. ↩

  37. Estimate: the same counts times each collection’s floor on CoinGecko on 27 September 2026, which comes to $2.64 million (992 ETH). ↩

  38. FKKS, on the Bored Ape Yacht Club licence: holders may use their Ape in business. Decrypt, celebrity owners: celebrities joined through 2021. ↩

  39. CoinDesk, 14 October 2022: 500 ETH, or $1,301,550, for Bored Ape number 3001 on 29 January 2022. ↩

  40. Decrypt calls it a floor Ape, and its traits come from on-chain metadata. The on-chain sales record shows the earlier sale in early May 2021 at about 0.24 ETH, which the episode’s ledger prices at under $1,000. ↩

  41. CNN, 10 February 2023: about $2.5 million worth of ether arrived in Bieber’s wallet from MoonPay before the purchase. The claim is CNN’s, and no claim is made here about why the money was sent. ↩

  42. CoinCentral and ARTnews: the class action was dismissed on 2 October 2025, with leave to amend. Whether it was refiled has not been checked. ↩

  43. OpenSea, Bored Ape 3001: a best offer of $17.1K on 27 September 2026. The cheapest Ape on CoinGecko was $17,231 the same day. ↩

  44. Euronews, reporting Reuters, 1 May 2022: the sale of 55,000 Otherdeeds, held on the last day of April 2022. ↩

  45. Estimate between two reports: Reuters, via Euronews gave around $285 million, and SiliconANGLE gave $320 million. ↩

  46. NFT Plazas: “investors spent over $176 million on fees alone”, in a mint that sold out in about three hours. The article does not name its data source. ↩

  47. $176 million divided by $300 million is 59 per cent. Against Reuters’ $285 million it is 62 per cent, and against SiliconANGLE’s $320 million it is 55 per cent, so the fees are above half on either figure. ↩

  48. Yuga Labs on X, 30 April 2022: “We’re sorry for turning off the lights on Ethereum for a while.”, posted at 11:53pm New York time. Also quoted by SiliconANGLE. ↩

  49. CoinGecko all-time-high floors: Bored Apes on 1 May 2022, Mutant Apes on 1 May (in ether), Otherdeeds on 2 May and Meebits on 4 May. The Mutant Apes’ high in dollars is dated 26 April. ↩

  50. Bored Ape Gazette: the rapper Spottie WiFi sold Otherdeed 90295, with a Mega Koda, for 190 ETH on 14 September 2022. ↩

  51. OpenSea, Otherdeed 90295: a best offer of $1,075.08 on 27 September 2026. ↩

  52. The Block, 28 October 2021: CryptoPunk 9998 appeared to sell for 124,457 ETH, about $532 million, through a flash loan taken and repaid inside one transaction. ↩ ↩2

  53. The closures are footnoted above. Decrypt, citing DappRadar, put organic NFT sales at about $24.9 billion in 2021, and Cointelegraph, citing CryptoSlam put them at about $5.63 billion in 2025. These come from two different trackers and are not a like-for-like comparison. ↩

  54. AFuckingNobody on X, 26 September 2026: a seven-part thread titled “The Whitehat, the MEV Bot, and the Marketplace: Mapping 0xQuit’s Overlapping Roles in NFT Security”, posted at 09:41 UTC. ↩ ↩2

  55. Etherscan, rescue wallet: first funded by osnipe.eth. The sleuth’s other on-chain links are left out. ↩

  56. Quit on X, 26 September 2026: “I’m an open book”, “osnipe and fwap are run entirely by me”, “They are me.”, and a closing line saying he just likes NFTs. In the same post he says Yuga “built our internal Otherside marketplace on PaymentProcessor” and “did not know that it had this bug”. ↩ ↩2 ↩3

  57. AFuckingNobody on X, 27 September 2026: a follow-up saying the evidence does not currently support a claim that Quit had pre-positioned the rescue wallet. X labels the post “Made with AI”. ↩

  58. Magic Eden on X, 25 September 2026, posted at 6:44am New York time: “a NFT trading protocol maintained by the company Limit Break” and “No live Magic Eden listings were impacted in this exploit.” ↩ ↩2

  59. Magic Eden’s Ethereum marketplace closed on 9 March 2026 and the statement came on 25 September 2026, a gap of six and a half months. See the Magic Eden help centre. ↩

  60. Magic Eden on X, 25 September 2026: “Not blaming, just stating exactly what happened”, posted at 9:42am New York time. ↩

  61. Limit Break on X, 25 September 2026: thanks “the heroic efforts of @0xQuit”, says the pause ability on v3 was added on 18 November 2024, calls V2 immutable “By design”, and adds “That is how web3 works. Please do not wait for us or anyone else to ‘fix’ this. Go revoke permissions NOW.” Quit’s thread says they “quickly paused Payment Processor V3”. ↩ ↩2 ↩3

  62. Quit on X, 25 September 2026: “last night cost me $7500 in gas”, posted at 3:00pm New York time. ↩

  63. Quit on X, 25 September 2026, thanking people who tipped through X Money, and Quit on X, saying a token launched in his name “has resulted in a big donation” though he is not a holder and does not endorse it. ↩

  64. Gary Vaynerchuk on X, 26 September 2026: “everyone in @veefriends world should know what kind of hero you are when NFT hacks happen!” ↩

  65. No post announcing a bounty or reward from Limit Break, Magic Eden or Yuga was found through 27 September 2026. This is a check for an absence, so it can only show that none was found by that date. ↩

  66. Magic Eden on X, 27 September 2026: a post promoting its Dicey casino. ↩

  67. Quit on X, 26 September 2026: “Claim site is live. If I was able to save your NFTs, you can now reclaim them. You will have to revoke the PaymentProcessor approval first”, posted at 02:47 UTC, which is 10:47pm New York time on 25 September. The Ape floor of about $17,000 is from the CoinGecko footnote above. ↩ ↩2

  68. Quit on X, 26 September 2026: “have no power atm”. Later, Quit on X, 27 September 2026: “doesn’t seem like power will be back tonight. maybe my sign to touch grass.”, posted at 8:47pm New York time on 26 September. ↩ ↩2

  69. SaylorEnergy on X, 26 September 2026, posted at 4:29am New York time. ↩

  70. SaylorEnergy on X, 26 September 2026, posted at 10:50am New York time: “Home safe. Thank you, Thank you. After another busy flying night I had to put these Apes to rest. Now, my family can rest thanks to your vigilance, honor, hard work, and caring for others.” ↩

  71. Two Apes at the cheapest-Ape floor on CoinGecko on 27 September 2026: 2 times $17,231 is $34,462. This is floor-based, because the sale prices of his own two Apes were not found, and ether was steady at about $2,700 across the period. ↩

  72. Quit on X, 26 September 2026: “~2750 NFTs have been returned to their rightful owners so far”, posted at 17:23 UTC, which is 1:23pm New York time. ↩

  73. 0xzxch on X, 25 September 2026: “Im sure a quarter of these NFTs were stolen from dead and forgotten wallets”. It is a guess, framed as one. ↩