Bored Ape Yacht Club: hacks, mishaps and controversies since 2021

Since 2021 the Bored Ape Yacht Club has been dogged by several hacks, a costly mishap at the launch of Otherside, an incident with UV light at ApeFest and proceedings before the courts and the US Securities and Exchange Commission. The largest theft through one of the club's channels came on April 25, 2022 via its hijacked Instagram account: 91 NFTs worth around $2.8 million. During the Otherdeed sale on April 30, 2022, buyers burned more than $157 million in gas fees. Yuga Labs won around $9 million against the artist Ryder Ripps in 2024; the judgment was overturned in 2025, and the two sides settled in April 2026. A court dismissed a class action against Yuga and celebrities in its then form in 2025; an amended complaint has been pending since October 2025 and has not yet been decided. According to Yuga, the SEC investigation ended in March 2025 without action.

Who calls the shots at Yuga today is described in our analysis of the Bored Ape Yacht Club in 2026.

Key points at a glance

• April 25, 2022: 91 NFTs, worth around $2.8 million, were lost through the hijacked Instagram account.
• April 30, 2022: more than $157 million in gas during the Otherdeed sale; Yuga refunded 90.57 ETH for failed transactions.
• November 4, 2023: at ApeFest in Hong Kong, according to Yuga, UV-A lights probably caused eye and skin complaints; Yuga was in contact with 15 people affected.
• March 3, 2025: according to Yuga, the SEC investigation ended without action.
• September 30, 2025: the court dismissed the class action over celebrity promotion in its then form; an amended complaint has been on file since October 10, 2025 and has not yet been decided.
• April 2026: settlement with Ryder Ripps, after the judgment of around $9 million had been overturned in 2025.

The major incidents at the Bored Ape Yacht Club since 2021

Sources: The Block, Decrypt, CoinDesk, Revoke.cash, court rulings, as of November 6, 2026.

Bored Ape Yacht Club hacks: Instagram and Discord, plus the airdrop and Limit Break

On March 17, 2022 a user bought a Bored Ape, used it to borrow five more via a flash loan through NFTX, claimed 10,094 APE for each of the six, 60,564 APE in total, from the airdrop and returned the borrowed Apes in the same transaction. According to The Block this yielded 399 ETH, around $1.1 million. According to Check Point Research, the cause lay in the airdrop process, not in the BAYC or APE contracts. No statement from Yuga on the matter is known.

On April 25, 2022 attackers took over the club's Instagram account and posted a fake airdrop. 91 NFTs were lost, among them 4 Bored Apes and 6 Mutant Apes, worth around $2.8 million according to The Block. Co-founder Greg Solano said two-factor authentication had been active and announced a review of the attack. We could not find it published.

On June 4, 2022 it was Discord's turn. Through the hijacked account of a community manager, attackers sent out a phishing link and, according to The Block, captured around 32 NFTs worth about 200 ETH, then around $360,000. Yuga spoke of a brief exploit of the server.

From September 24, 2026 attackers exploited a vulnerability in Limit Break's Payment Processor, a trading contract to which many holders had granted an approval via Magic Eden's former Ethereum marketplace. According to Revoke.cash they captured around 622 WETH and NFTs worth at least $2.5 million, mainly on Ethereum, Polygon and Base; after returns, around $3.4 million remains lost. Security researchers led by Yuga developer 0xQuit used the same vulnerability to bring more than 200,000 NFTs to safety, and owners recovered assets worth more than $4 million. Limit Break advised revoking all approvals immediately, and on September 30 Yuga warned that the attacks were continuing. More on this is in our report on the Limit Break vulnerability.

Launch mishaps: $157 million in gas for Otherdeeds

On April 30, 2022 Yuga Labs sold 55,000 Otherdeeds, the land plots in the Otherside metaverse, at 305 APE each. The rush drove fees on Ethereum sharply higher: according to Decrypt, buyers burned more than $157 million in gas, and some paid 2.6 to 5 ETH for a single transaction. Many transactions failed, but the gas was gone all the same.

On May 4, 2022 Yuga refunded the gas, but only for failed transactions, as Decrypt reported. According to Etherscan, 90.57 ETH flowed back, then around $265,500. Those who had bought successfully got nothing back, and some buyers reported missing refunds, according to Fortune. What became of Otherside is shown in our overview of Yuga Labs' projects.

ApeFest Hong Kong 2023: UV-A light and eye complaints

After the main night of ApeFest on November 4, 2023 in Hong Kong, guests reported eye pain and skin irritation. According to Artnet, Yuga urged those affected in a statement to see a doctor. According to The Block, the company was in contact with 15 people, by its own account less than 1 percent of the roughly 2,250 guests and staff. Media reported more than 15 cases, some more than 20.

On November 9, 2023 Yuga and the agency Jack Morton Worldwide named the likely cause, according to CoinDesk: UV-A lights in one corner of the venue. According to Decrypt, the founder of the company Artfi sent Yuga a legal letter, in his words the first step towards a lawsuit. No outcome is publicly known. Every festival since 2021 is covered in our history of ApeFest.

Law and regulation: Ryder Ripps, the class action and the SEC

Ryder Ripps: allegations, trademark suit and settlement

From early 2022 the artist Ryder Ripps and the YouTuber Philion alleged that the club's images and logo contained racist caricatures and Nazi references. Yuga rejected this: in June 2022, according to Decrypt, co-founder Wylie Aronow (“Gordon Goner”) called the allegations a disinformation campaign and described the founders as a group of Jewish, Turkish, Pakistani and Cuban friends. Mark Pitcavage of the Anti-Defamation League told Input he saw no connection between the logo and the Nazis' death's-head symbol.

Together with Jeremy Cahen, Ripps sold a collection with the same images under the name RR/BAYC, which both described as satirical conceptual art. Yuga sued for trademark infringement in June 2022, while Ripps invoked fair use and freedom of expression. A US district court ruled for Yuga in a partial judgment in April 2023, set damages at around $1.6 million at the end of October 2023 and, in its final judgment in early February 2024, awarded Yuga around $9 million according to The Block, including around $7 million in legal fees.

On July 23, 2025 the appeals court, the Ninth Circuit, held that NFTs are goods under trademark law and rejected Ripps' free-speech and nominative-use defences. It nonetheless overturned the partial judgments on trademark infringement and the domains, because likelihood of confusion could not be established without a trial, and sent the case back, according to the ruling. In April 2026 the two sides settled, according to Hypebeast: a permanent injunction, with RR/BAYC's contracts, domains and remaining NFTs going to Yuga; no payments were reported. No court has ruled on the allegations about the symbols; the case concerned trademark and domain law as well as counterclaims by Ripps.

Class action: promotion by celebrities

On December 8, 2022 the law firm Scott+Scott filed a class action in California against around 40 defendants, among them Yuga, Sotheby's and celebrities such as Justin Bieber, Paris Hilton and Madonna. The allegation: the celebrities had promoted the NFTs for payment and without disclosure, and the payment service MoonPay had been used as a covert channel. Yuga rejected this and, according to The Block, considered the suit opportunistic. In June 2023 The Block reported, citing two sources, that MoonPay had given Apes to some celebrities, which MoonPay denied.

On September 30, 2025 Judge Fernando Olguin dismissed the suit in its then form and set a deadline for an amended complaint. The plaintiffs had not adequately shown that the NFTs and ApeCoin are securities, nor that they had seen the celebrities' promotion, as Decrypt and CoinCentral reported. On October 10, 2025 the plaintiffs filed an amended complaint. Yuga and the other defendants again moved to dismiss; according to the court docket, a ruling is still pending (as of November 6, 2026).

SEC: an investigation without action

From October 2022 the US Securities and Exchange Commission investigated Yuga's NFTs and ApeCoin. On March 3, 2025 Yuga announced, according to The Block, that the SEC had closed the investigation without action. The agency itself did not comment.

The founders unmasked in 2022

On February 4, 2022 BuzzFeed News named the founders, until then known only by their pseudonyms, as Greg Solano (“Gargamel”) and Wylie Aronow (“Gordon Goner”), identified through company records in Delaware. Yuga Labs confirmed the names, and Aronow wrote, according to Decrypt, that he had been unmasked against his will. A debate followed, according to Artnet, over whether this was journalism or doxxing, meaning the unwanted publication of someone's identity. Both founders have since appeared in public.

DAO spending: cars, Formula 1 and NFT purchases

What the ApeCoin DAO spent its money on was also contested. In 2024 holders voted to approve around $210,000 in APE for a BMW with which an influencer was to produce content about ApeCoin, €5.125 million for a two-year partnership with the BWT Alpine Formula 1 team and, in 2023, eleven million APE, then around $12 million, for NFT purchases. The proposers justified the projects as marketing and as a way of strengthening the ecosystem; in June 2025, according to Decrypt, Solano criticised too much spending on prestige projects. In June 2025 the DAO voted by 99.66 percent to dissolve itself. What happened next is covered in our article on the people behind Yuga Labs.

Other incidents: the NTS party and the social lead's resignation

In November 2022 the radio station NTS announced a party with the Bored Ape Yacht Club in Miami and, according to Resident Advisor, met with a backlash because of the racism allegations. NTS pointed to the Anti-Defamation League's assessment, and the party took place in early December 2022.

On November 5, 2023 Yuga Labs' social lead resigned after old tweets of his had surfaced, which Decrypt describes as racist and antisemitic. He apologised and wrote that the tweets did not reflect who he was. According to Decrypt, Yuga confirmed his employment and resignation, and nothing more.

Bored Ape security: four habits that cut the risk of theft

With Instagram, Discord and Limit Break, the cause lay not in the Apes' contract but in signatures on fake sites and in old approvals. Four habits reduce the risk.

• Check your approvals. Most marketplaces ask for an approval covering the entire collection at the first sale, and it remains valid until you revoke it. Withdrawing a listing does not cancel it; services such as Revoke.cash show every approval in your wallet. Which marketplaces charge which fees is shown in our NFT marketplace comparison.
• Keep valuables separate. An Ape belongs in a wallet you do not mint with and do not connect to third-party sites. A hardware wallet protects the key, but not against a signature you confirm yourself. Suitable devices are listed in our hardware wallet comparison.
• Use official links only. Even a genuine account can post a fake link. Check mints and claims on the club's official site; fake claim pages can be spotted with our guide to the Mudwater claim.
• Read the fees before you confirm. During large sales fees rise within minutes, and even a failed transaction costs gas.

Disclosure: Dennis Weidner, founder of Cryptoticker, holds Bored Apes, Mutant Apes and Otherdeeds; Cryptoticker took over the BMW Apecar in 2025. This article is not investment advice.

(As of November 6, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)