What Can We Learn from Two Separate Scams That Cost NFT Whales Seven Bored Apes?
TechFlow Selected TechFlow Selected
What Can We Learn from Two Separate Scams That Cost NFT Whales Seven Bored Apes?
User lazslo_btc lost 7 Apes in two separate but consecutive scams, worth over $700,000.
Navigating Web3 tides with focused insightsWritten by: 0xQuit
Compiled by: TechFlow
Today, user lazslo_btc lost seven Apes in two separate but consecutive scams, amounting to over $700,000. Let's take a look at what happened and what lessons we can learn from it.
When reviewing Laszlo's transaction history, the first thing we notice is a series of setApprovalForAll calls, which is never a good sign.
Upon closer inspection, we see that the first approval was for x2y2, which is normal and safe—we can infer that Laszlo at least intended to sell one Ape.
The second approval was for "0x Protocol," the engine powering many popular trading platforms including Sudoswap. This in itself isn't dangerous either, although seeing two consecutive approvals for 0x suggests Laszlo wasn’t paying close attention to his actions.
The second approval was essentially just a waste of gas—it didn’t do anything. Anyone more careful would have realized they had already approved the contract and didn’t need to do it again.
The next step was a trade on Sudoswap. Given the prior 0x approval, we might assume this was legitimate. But we see he exchanged one Ape for a Crystal Dog. That immediately raises suspicion. Looking up the Crystal Dog’s contract address and inspecting the NFT reveals it was a counterfeit disguised as an Ape.
So he fell for the first scam—a phishing attempt using a fake BAYC, a relatively common fraud tactic. At this point, it's hard to imagine what led Laszlo into the second scam, but something convinced him to keep trading—likely the same person who had just scammed him.
Twelve minutes after "filling the order" on Sudoswap, Laszlo once again set ApprovalForAll for BAYC. This time, however, it wasn't for x2y2 or 0x Protocol—but for an unverified phishing contract deployed just 50 days earlier.
My guess is that he was tricked by a fake website, or worse, someone promised to “recover” the first stolen Ape. Only Laszlo can tell us how these two scams are connected—for now, we can only speculate.
Lesson:
Websites like Sudoswap do not vet the assets being traded. They are powerful tools, but you must perform your own due diligence. Just because an image looks like a BAYC doesn’t mean the NFT is authentic.
If you're trading on an unfamiliar website, always double-check exactly what you're approving—or better yet, avoid trading on unknown sites altogether.
Pause and think before trading: if you believe you need to set four approvals for the same thing, you shouldn't be trading anything (especially not seven-figure JPEGs).
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
