Crypto sleuth says wrong suspect was held in $1M Bored Ape NFT theft

Cybersecurity researcher ZachXBT has revealed that law enforcement mistakenly detained Sam Curry, a former Yuga Labs security expert, in connection with a December 2022 theft of 14 Bored Ape Yacht Club NFTs valued at over $1 million.

According to ZachXBT’s May 9 post on X, he identified the actual suspect’s wallet and linked it to a now-deleted social media account through forensic tracing methods.

ZachXBT explained that police had reviewed OpenSea logs containing Curry’s home IP address, which led to his wrongful detention in 2023.

“In reality, as part of his security work at Yuga Labs, [Curry] had been investigating the theft and used a private key embedded in the website’s JavaScript by the threat actor,” ZachXBT said.

The attacker had stolen 14 NFTs from the Bored Ape Yacht Club collection, which traded for roughly $86,000 each at the time of the incident.

ZachXBT employed on-chain forensic techniques, including tracking the flow of stolen funds through Tornado, an Ethereum mixer, to pinpoint a likely suspect.

He urged law enforcement to obtain all data related to the individual’s social media accounts and analyse on-chain transactions linked to the suspect’s wallet.

The Bored Ape Yacht Club, launched in 2021, remains one of the most valuable NFT collections with a market capitalisation exceeding $300 million.

As of early May 2025, individual Bored Ape NFTs trade around $30,000 each, with prices varying based on unique traits.

This case highlights the challenges authorities face in investigating complex cybercrimes involving decentralised and pseudonymous blockchain assets.

ZachXBT expressed regret that a security researcher was detained while stronger leads on the actual threat actor existed.