Man charged over Bored Ape Yacht Club NFT theft

A man has been charged with spoofing OpenSea, the first and biggest non-fungible token (NFT) trading site, to steal ownership rights to digital works of art worth nearly half a million dollars from a single victim. The stolen haul allegedly included an image from the popular Bored Ape Yacht Club.

Soufiane Oulahyane, 25, aka “Soufiane Oulahya,” potentially faces years behind bars in a US prison if convicted, but would first have to be extradited: he is being held in Morocco, from where Cybernews understands he originates, on separate charges there.

In September 2021, Oulahyane allegedly set up a bogus portal that mimicked OpenSea, the most established trading platform for NFTs, a bizarre concept in which people are willing to pay often vast sums of money for the digital rights to a popular image that can nevertheless be viewed freely by anyone else online.

Oulahyane’s alleged victim is said to have been robbed of their precious art tokens and other digital assets after he convinced them to enter their seed phrase, a sort of password that controls access to a cryptocurrency wallet, and login details to a phony website he is accused of setting up as a lure.

Bored Ape Yacht Club image — Exhibit A: Bored Ape Yacht Club NFT allegedly stolen using fake OpenSea website

US authorities claim that Oulahyane deployed paid ads on a search engine to boost his spoof version of the OpenSea website to appear at the top of results returned for entering the keyword “opensea.” The bogus portal was allegedly cunningly crafted to resemble the real thing, complete with a login page to dupe victims into parting with their credentials.

Once they entered those, they were automatically relayed to an email account said to be controlled by Oulahyane, the US Department of Justice says.

Announcing the unsealing of charges against Oulahyane at a federal court in New York on July 10th, US Attorney Damian Williams said: “As alleged, Soufiane Oulahyane used a common cybercrime technique to steal victim cryptocurrency and NFTs. ‘Spoofing’ is one of the oldest tricks in the criminal playbook. Oulahyane adapted this old tool for use in a new and developing arena – the crypto space.”

Meebit NFT — Exhibit B: Meebit token is also alleged to have been part of stolen haul worth nearly $450,000

This trick allegedly enabled Oulahyane to steal around 40 high-profile NFTs from the victim including digital rights to images from the Bored Ape Yacht Club, Bored Ape Kennel Club, CryptoDad, and Meebit series.

The FBI helped to bring the case to trial and showed no signs that the suspect being held abroad would deter it from trying to bring him to justice, if indeed he is proven guilty.

Its acting assistant director in charge, Christie Curtis, said: “The FBI is committed to holding all individuals who conduct malicious cyberattacks against US interests accountable — no matter where in the world they are located.”

If successfully extradited, Oulahyane will face charges of wire fraud, which carries a maximum sentence of 20 years, using an unauthorized access device, up to ten years, manipulating transactions with said device to receive something worth at least $1,000, up to 15 years, and aggravated identity theft, which imposes a mandatory consecutive sentence of two years.

“The charges unsealed today should serve as a reminder that digital assets, such as cryptocurrency and NFTs, are not immune from cyber fraudsters and that my office is committed to prosecuting these fraudsters both here and abroad,” said Williams.

The real OpenSea was launched in 2017 as a major trading platform for NFTs on the Ethereum digital currency blockchain.