NFT marketplace OpenSea hit with $1 million Bored Ape lawsuit

Quick Take

  • Timothy McKimmy says his Bored Ape NFT was sold for $26 without his permission.
  • He’s accusing OpenSea of failing to act on security vulnerabilities in its platform.

OpenSea, the popular NFT marketplace, has been hit with a $1 million lawsuit brought by a disgruntled user who lost a Bored Ape NFT this month.

A collector named Timothy McKimmy is suing OpenSea in Texas for security vulnerabilities on its platform that caused his prized NFT to be sold far below fair value, according to a case filed last Friday. McKimmy’s complaint is based on a listing bug that saw his Bored Ape #3475 NFT, which he bought for 55 ETH ($137,000), sold for 0.01 ETH ($26) earlier this month.

At the time of the sale, the Bored Ape Yacht Club floor price was 100 ETH ($305,000), according to data from CoinGecko. The attacker even “flipped” the NFT in question for 98.9 ETH moments later.

As part of the suit, McKimmy says OpenSea failed to address the security issues, putting users’ NFTs at risk. The plaintiff is one of several users that reported falling for the listing bug mishap.

The Listing Bug

The listing bug happened when users moved their NFTs from their wallets linked to OpenSea to a different address without canceling the previous listing. Users likely elected not to cancel the listing because the step required paying a transaction fee.

Once moved to a new wallet, users likely set a new selling price which did not cancel the listing price on the OpenSea-linked wallet. The problem arose when users moved NFTs back to their OpenSea-linked wallets, activating the previous, lower listing price. Rogue actors were then able to snipe premium NFTs for a bargain price.

McKimmy’s suit demands the return of his Bored Ape as well as damages to the tune of $1 million, arguing that Bored Apes with rarity scores lower than his have sold for 500 ETH ($1.3 million).

OpenSea has three weeks to respond to the suit. Meanwhile, the company is also dealing with the fallout from a phishing attack that saw NFTs worth millions stolen from users last week.

Case number 4:22-cv-00545 was filed before the Southern District of Texas (Houston Division).

© 2023 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.