OpenSea finally refunds the victims of the recent listing bug. To date, a total of 750 ETH has been released to the affected users. In addition, the company released a listing fix to prevent such events in the future.
The listing bug had been making headlines in the NFT community, as bad actors were able to snipe some of the most notable NFTs for peanuts. The affected collections include Bored Ape Yacht Club, Mutant Ape Yacht Club, Cool Cats, and CyberKongz NFTs. The refund cannot possibly make up for all the losses incurred, but I guess it is what it is at this point.
The listing bug is essentially an exploit on the OpenSea system, where NFTs are sold using old listing prices that were never manually cancelled by the owner. The attackers chose several blue-chip NFTs as their target. These collections have seen tremendous growth over the past year, creating a large gap between the old listing price and the current market value. Therefore, all such listings, especially those listed before OpenSea implemented listing expiry dates were at risk.
Another cause of this exploit is the high Ethereum gas fees incurred if users were to cancel a listing manually. As such, many experienced users transferred the NFTs to another wallet, and then transferred it back to the original wallet. Apparently, this action removes the listing, or so it would seem on the OpenSea UI.
Updates for Listing and Delisting
Prior to the refunds, OpenSea released a guide regarding listing and delisting NFTs for the benefit of the users. The company also implemented several updates to prevent future issues.
Firstly, they changed the default listing duration from 6 months to 1 month. This can significantly reduce the risks. In addition, the OpenSea UI now includes a dashboard that displays all active listings in an account. Lastly, the system will alert users when an NFT with an active listing leaves the wallet.