Hackers breached the Instagram page of Bored Ape Yacht Club, a popular nonfungible token collection, and used the page to steal digital assets estimated to be worth about $3 million.

Yuga Labs LLC, the company that created the Bored Ape Yacht Club collection, disclosed the breach today. 

A nonfungible token or NFT is a unique digital asset stored on a blockchain that users can buy and sell. Interest in such digital assets has grown significantly over the last few years. The price of the most popular NFTs can run into the millions of dollars in some cases. 

The Bored Ape Yacht Club is one of the most popular NFT collections on the market. The collection reportedly comprises 10,000 NFTs based on the Ethereum blockchain. Yuga Labs, the creator of the Bored Ape Yacht Club, received a $4 billion valuation earlier this year after raising $450 million in funding from a group of investors led by Andreessen Horowitz.

Yuga Labs told Vice today that hackers had gained access to the Instagram page for the Bored Ape Yacht Club collection and shared a post containing a malicious link. The post led users to believe that clicking the link would allow them to participate in an airdrop, the term for an event where NFTs are distributed to participants. Users were instead directed to a malicious website that tricked them into sending their NFTs to a digital wallet controlled by the hackers.

Yuga Labs said in a statement that “two-factor authentication was enabled and the security practices surrounding the IG account were tight. Yuga Labs and Instagram are currently investigating how the hacker was able to gain access to the account. We’re still investigating.”

It’s believed that hackers stole four NFTs from the Bored Ape Yacht Club collection, as well as nine NFTs from two other NFT collections managed by Yuga Labs. There are also “assorted other NFTs” among the stolen digital assets, the company said.

“Rough estimated losses due to the scam are 4 Bored Apes, 6 Mutant Apes, and 3 BAKC, as well as assorted other NFTs estimated at a total value of ~$3m,” Yuga Labs stated.

On the official Twitter page for the Bored Ape Yacht Club collection, a tweet has been posted warning users that “there is no mint going on today. It looks like BAYC Instagram was hacked. Do not mint anything, click links, or link your wallet to anything.”

Yuga Labs first alerted users to the breach at 9:53 a.m. EDT, then “removed all links to Instagram from our platforms and attempted to recover the hacked Instagram account,” the company stated today. 

Image: Bored Ape Yacht Club