# The Artchitech's stolen Beeples

By [radicalnotions.eth](https://paragraph.com/@radicalnotions) · 2024-06-01

---

Beeple’s [latest everyday](https://x.com/beeple/status/1796232883084083705) tweet includes a cryptic message and if you dig a little deeper you find a story involving [Sotheby’s](https://twitter.com/Sothebys), [Beeple](https://twitter.com/beeple), [TheArtchitech](https://TheArtchitech) and stolen art!

Follow my on-chain investigation into how the art was stolen, how it was washed on it’s way to Sotheby’s wallet and where it is now!

[https://x.com/beeple/status/1796232883084083705](https://x.com/beeple/status/1796232883084083705)

I take a keen interest in all things Beeple and I’ve been lucky enough to win a number of prizes [solving](https://x.com/RadicalnotionsE/status/1769950817941864726) his [puzzles](https://x.com/RadicalnotionsE/status/1603136825685864449). So when I saw a Beeple 1/1 and 2 x 1/3s [leave a single wallet](https://etherscan.io/tx/0x74cb68e163a8f635034b84bc5f7860729939296520f38890f8bc08629c8c3845) and get sold into bids I followed the trail that ultimately ended at Sotheby.

[https://x.com/RadicalnotionsE/status/1603136825685864449](https://x.com/RadicalnotionsE/status/1603136825685864449)

The three Beeples stolen were [30K #1/1](https://opensea.io/assets/ethereum/0xdd012153e008346591153fff28b0dd6724f0c256/100100001), [DEAD #3/3](https://opensea.io/assets/ethereum/0xdd012153e008346591153fff28b0dd6724f0c256/100120003) and \[ALIVE #3/3\]([https://ALIVE](https://ALIVE) #3/3), the same three pieces that feature in Beeple’s everyday above. They were stolen after a re-entrancy vulnerability was discovered in NFTTrader. This vulnerability allowed anyone to steal assets that were approved for NFTTrader. The [TheArtchitech](https://TheArtchitech) was exploited for his three Beeples in this [transaction](https://etherscan.io/tx/0x74cb68e163a8f635034b84bc5f7860729939296520f38890f8bc08629c8c3845).

For a deeper dive of the exploit itself check out [@cygaar](https://x.com/0xCygaar)’s detailed writeup.

[https://x.com/0xCygaar/status/1736056050816876626](https://x.com/0xCygaar/status/1736056050816876626)

Unfortunately, almost a year before the exploit, [TheArtchitech](https://TheArtchitech) had approved NFTTrader to transfer any of their Beeple assets via `setApprovalForAll()` (see this [transaction](https://etherscan.io/tx/0xfc7fa1525279c298b85805fbe1f4e2bb135249bbb3d48579316cde0c5dcae8bc)). With this approval and the re-entrancy exploit the attacker was able to transfer all three of the Beeples from [TheArtchitech](https://TheArtchitech) to their own attack contract.

Approvals are a normal part of buying, selling and trading NFTs however it’s important to always revoke permissions if you don’t intend to sell the assets as approvals don’t expire. They are reset when assets are transferred between wallets and this is why a lot of collectors have multiple wallets or a vault to transfer assets to, resetting their approvals.

After exploits like this the valuable NFTs are generally sold into WETH bids and I always found it strange (or lucky) that these three high value Beeples were all sold to the same account [Doge\_Doge](https://opensea.io/Doge_Doge). All three pieces were sold for approximately 9 WETH or 27.21 WETH in total. See the [sale transaction](https://etherscan.io/tx/0x7e2ec45ef24bafc8f04d1d6638494b7f333306c1afce2e5cdbb75ac60011fe27).

Looking at the sale transaction the attacker [0x0000000000000F25a072EFA232D8EFc0b5CE2436](https://etherscan.io/address/0x0000000000000f25a072efa232d8efc0b5ce2436) bundled 3 bids from [Doge\_Doge](https://opensea.io/Doge_Doge) and submitted them to Seaport’s `fulfillAvailableAdvancedOrders()`.

Diving deeper into the offers and considerations you can see that [Doge\_Doge](https://opensea.io/Doge_Doge) was very specific with their offers. They made offers for the BEEPLE - SPRING/SUMMER COLLECTION 2021 contract 0xdd012153e008346591153fff28b0dd6724f0c256 and tokens [100110003](https://etherscan.io/token/0xdd012153e008346591153fff28b0dd6724f0c256?a=100110003) [ALIVE #3/3](https://opensea.io/assets/ethereum/0xdd012153e008346591153fff28b0dd6724f0c256/100110003), [100100001](https://etherscan.io/token/0xdd012153e008346591153fff28b0dd6724f0c256?a=100100001) [30K #1/1](https://opensea.io/assets/ethereum/0xdd012153e008346591153fff28b0dd6724f0c256/100100001) and [100120003](https://etherscan.io/token/0xdd012153e008346591153fff28b0dd6724f0c256?a=100120003) [DEAD #3/3](https://opensea.io/assets/ethereum/0xdd012153e008346591153fff28b0dd6724f0c256/100120003).

![](https://storage.googleapis.com/papyrus_images/8b6f45afe507e7c67d6497caad8d307d3b85cc25f9d07475617bbaded1501899.png)

It’s also interesting to look at the time windows these three offers were available to be fulfilled by the attacker;

*   1702755279 to 1702757078 for token [100100001](https://etherscan.io/token/0xdd012153e008346591153fff28b0dd6724f0c256?a=100100001)
    
    *   Sat Dec 16 2023 19:34:39 to Sat Dec 16 2023 20:04:38 ~ 30 mins
        
*   1702755404 to 1703014603 for token [100110003](https://etherscan.io/token/0xdd012153e008346591153fff28b0dd6724f0c256?a=100110003)
    
    *   Sat Dec 16 2023 19:36:44 to Tue Dec 19 2023 19:36:43 ~ 3 days
        
*   1702755381 to 1703014579 for [100120003](https://etherscan.io/token/0xdd012153e008346591153fff28b0dd6724f0c256?a=100120003)
    
    *   Sat Dec 16 2023 19:36:21 to Tue Dec 19 2023 19:36:19 ~ 3 days
        

It’s same to assume that [Doge\_Doge](https://opensea.io/Doge_Doge) made the three offers for ~9 WETH between 19:34 and 19:36 on Sat Dec 16. The [exploit](https://etherscan.io/tx/0x74cb68e163a8f635034b84bc5f7860729939296520f38890f8bc08629c8c3845) occurred approximately 3 hours earlier that day at 16:26. The timeline leading up to the sale is interesting;

1.  The hack of [TheArtchitech](https://TheArtchitech) happens at 16:26 UTC December 16th in this [transaction](https://etherscan.io/tx/0x74cb68e163a8f635034b84bc5f7860729939296520f38890f8bc08629c8c3845). After the hack the Beeples reside in the attacker’s smart contract [0x000000000000c35e4364deffa9059dbadaefd4f8](https://etherscan.io/address/0x000000000000c35e4364deffa9059dbadaefd4f8).
    
2.  At 14:29 December 16th in this [transaction](https://etherscan.io/tx/0x2fdcfd95cee44001b05104ef5358f8ef5dc20fe3a53663a6cabb4a8be5c09891) the Beeples are moved from the attacker’s smart contract to another smart contract presumably owned by the attacker [0x0000000000000f25a072efa232d8efc0b5ce2436](https://etherscan.io/address/0x0000000000000f25a072efa232d8efc0b5ce2436).
    
3.  At 17:38 December 16th [Doge\_Doge](https://opensea.io/Doge_Doge) swaps 10ETH for WETH in this [transaction](https://etherscan.io/tx/0x4f513595ba46e81a40d861801ddc9a5327cd3dd15573eaa2f44a1589fcfe0592). They will ultimately need around 27 WETH to bid 9 WETH on each of the Beeples.
    
4.  At 19:27 December 16th [Doge\_Doge](https://opensea.io/Doge_Doge) removes 17.95 ETH from Blur Pool in this [transaction](https://etherscan.io/tx/0x6886031f0a527b49667c15ae38dc56eefe0ae68ad30c8a419f8605ee83ff181c).
    
5.  At 19:31 December 16th [Doge\_Doge](https://opensea.io/Doge_Doge) wraps 18 ETH to 18 WETH in this [transaction](https://etherscan.io/tx/0xc34b4754a7441e5d2d83bac8625e135f68e740d0520cfb19abbe15e97dff709c).
    
6.  From 19:34 to 19:46 December 16th [Doge\_Doge](https://opensea.io/Doge_Doge) makes 3 offers all at ~9WETH for the three Beeples.
    
7.  At 19:40 the attacker bundles all three offers and sells the Beeples to [Doge\_Doge](https://opensea.io/Doge_Doge) for 27.21 WETH in this [transaction](https://etherscan.io/tx/0x7e2ec45ef24bafc8f04d1d6638494b7f333306c1afce2e5cdbb75ac60011fe27).
    

As I alluded to earlier [Doge\_Doge](https://opensea.io/Doge_Doge) was lucky to be in the right spot at the right time with the right WETH, receiving all three Beeples for 27.21 WETH. Their actions after the sale suggest they knew the Beeples were stolen and they should attempt to hide the part they played in moving the goods to their final sale. This sale was likely to be at none other then a Sotheby’s auction.

![TheArtchitech's Beeples in Sotheby's Auction Wallet](https://storage.googleapis.com/papyrus_images/8cb464814e23680c8be459636bcd872fab16d3dc69926efdf156f18c54280a01.png)

TheArtchitech's Beeples in Sotheby's Auction Wallet

After the [sale](https://etherscan.io/tx/0x7e2ec45ef24bafc8f04d1d6638494b7f333306c1afce2e5cdbb75ac60011fe27) from the attacker to [Doge\_Doge](https://opensea.io/Doge_Doge) there are some strange zero value swaps on X2Y2 and asset transfers that move the stolen assets between a series of wallets, some of these wallets are linked via direct ETH transfers;

*   08:05 December 17 the Beeples are transferred from [Doge\_Doge](https://opensea.io/Doge_Doge) address [0x2e95e1cd077f29733c65d885ce7afe278d0726a6](https://etherscan.io/address/0x2e95e1cd077f29733c65d885ce7afe278d0726a6) to [0x59b15a752c0176f60b8c3ccea68de9f0c0930879](https://etherscan.io/address/0x59b15a752c0176f60b8c3ccea68de9f0c0930879) in this [transaction](https://etherscan.io/tx/0x4e6c8b6dd152e30ff326eced15ee510d46d3705b4d3fff8a83fe2007023fbebc). This is a zero value swap on X2Y2. Note that there’s no value transferred to [Doge\_Doge](https://opensea.io/Doge_Doge). All assets are transferred to [0x59b15a752c0176f60b8c3ccea68de9f0c0930879](https://etherscan.io/address/0x59b15a752c0176f60b8c3ccea68de9f0c0930879) and [Doge\_Doge](https://opensea.io/Doge_Doge) receives no value in return (see the graph below).
    

![https://app.blocksec.com/explorer/tx/eth/0x4e6c8b6dd152e30ff326eced15ee510d46d3705b4d3fff8a83fe2007023fbebc](https://storage.googleapis.com/papyrus_images/fe24787e1717c1e61a1051b9f225b8124800534be8e5a329bfa62aa194eea306.png)

https://app.blocksec.com/explorer/tx/eth/0x4e6c8b6dd152e30ff326eced15ee510d46d3705b4d3fff8a83fe2007023fbebc

*   In three separate transactions on January 6th 2024 the Beeples are moved from [0x59b15a752c0176f60b8c3ccea68de9f0c0930879](https://etherscan.io/address/0x59b15a752c0176f60b8c3ccea68de9f0c0930879) to [0x3e4a162dc103d4357c0204b37ccc5168dfca0d97](https://etherscan.io/address/0x3e4a162dc103d4357c0204b37ccc5168dfca0d97), at [08:07](https://etherscan.io/tx/0x42a01f6df702501f85b1bbd110dec699c45925527494ec46f8a41a826f211ce4), [08:08](https://etherscan.io/tx/0x056dd78974ad372a7bd4cdf207218a7bb3e4bc5d95a942e352f796c779f8b173) and [08:09](https://etherscan.io/tx/0x5424a3fbe3f8889738c367e19dbe295316a41f38e64a4109a1a52a9210a7e537).
    
*   At 08:23 the same day another zero value swap occurs on X2Y2 transferring the assets from [0x3e4a162dc103d4357c0204b37ccc5168dfca0d97](https://etherscan.io/address/0x3e4a162dc103d4357c0204b37ccc5168dfca0d97) to [0x1fd10b2f9f58702fbe6845131efe67ff3e28f5ff](https://etherscan.io/address/0x1fd10b2f9f58702fbe6845131efe67ff3e28f5ff) in this [transaction](https://etherscan.io/tx/0x5d3654edc94e3bf161ac0ad15aa2165bb170237806093369e3133e42597dfafb). Note similar to the swap above [0x3e4a162dc103d4357c0204b37ccc5168dfca0d97](https://etherscan.io/address/0x3e4a162dc103d4357c0204b37ccc5168dfca0d97) receives no value in return.
    

![https://app.blocksec.com/explorer/tx/eth/0x5d3654edc94e3bf161ac0ad15aa2165bb170237806093369e3133e42597dfafb](https://storage.googleapis.com/papyrus_images/0ce0e67a74551d3f3a26d10681a4f4b5d0a0a45fbeb6468840814bde9320e23c.png)

https://app.blocksec.com/explorer/tx/eth/0x5d3654edc94e3bf161ac0ad15aa2165bb170237806093369e3133e42597dfafb

*   At 08:24 in a separate transaction [0x3e4a162dc103d4357c0204b37ccc5168dfca0d97](https://etherscan.io/address/0x3e4a162dc103d4357c0204b37ccc5168dfca0d97) sends [0x1fd10b2f9f58702fbe6845131efe67ff3e28f5ff](https://etherscan.io/address/0x1fd10b2f9f58702fbe6845131efe67ff3e28f5ff) 0.0332 ETH in this [transaction](https://etherscan.io/tx/0x36974f5fd75b33a9576b4407ab965e37032fefb0eae2fc5a718d349f1a5b5f7c). This is presumably for gas _and links these two wallets_ beyond just the swapping of assets for zero value.
    
*   At 10:48 on January 6th (same day) the Beeples move between wallets again via another zero value swap on X2Y2. The assets move from [0x1fd10b2f9f58702fbe6845131efe67ff3e28f5ff](https://etherscan.io/address/0x1fd10b2f9f58702fbe6845131efe67ff3e28f5ff) to [0xeafdb3519a43578c08f17583cb862739c3deab27](https://etherscan.io/address/0xeafdb3519a43578c08f17583cb862739c3deab27) in this [transaction](https://etherscan.io/tx/0x9cd658b6c11ae8f067e8640d5ca71827b349314397051513f67f4dff186d6b00).
    

![https://app.blocksec.com/explorer/tx/eth/0x9cd658b6c11ae8f067e8640d5ca71827b349314397051513f67f4dff186d6b00](https://storage.googleapis.com/papyrus_images/efd70230eae30b98d9bb8ef4d70f492fa660ccb3f9bf1bdef834b525e98f52dc.png)

https://app.blocksec.com/explorer/tx/eth/0x9cd658b6c11ae8f067e8640d5ca71827b349314397051513f67f4dff186d6b00

*   Around 10 days later on January 16th 2024 at 16:22 the wallet that is currently holding the stolen Beeples [0xeafdb3519a43578c08f17583cb862739c3deab27](https://etherscan.io/address/0xeafdb3519a43578c08f17583cb862739c3deab27) transfers 2.1 ETH to [Doge\_Doge](https://opensea.io/Doge_Doge). This links [0xeafdb3519a43578c08f17583cb862739c3deab27](https://etherscan.io/address/0xeafdb3519a43578c08f17583cb862739c3deab27) to the [Doge\_Doge](https://opensea.io/Doge_Doge) wallet [0x2e95e1cd077f29733c65d885ce7afe278d0726a6](https://etherscan.io/address/0x2e95e1cd077f29733c65d885ce7afe278d0726a6). It may be coincidence or it may be that all of these transfers and wallets were controlled by [Doge\_Doge](https://opensea.io/Doge_Doge). See the wallet graph below;
    

![Wallets involved in Beeple NFT or ETH transfers](https://storage.googleapis.com/papyrus_images/b7a883895fe26670171efd38b188eeff3e2fdfb6c6c8b8938fa521107e81ff4c.png)

Wallets involved in Beeple NFT or ETH transfers

*   Finally on the 21st Feb 2024 the Beeples are transferred from [0xeafdb3519a43578c08f17583cb862739c3deab27](https://etherscan.io/address/0xeafdb3519a43578c08f17583cb862739c3deab27) to [Sothebys-Auction](https://opensea.io/Sothebys-Auction) wallet [0x55eca4d1c9ea7021509a7cd88c68c279dabdd37d](https://etherscan.io/address/0x55eca4d1c9ea7021509a7cd88c68c279dabdd37d) in this [transaction](https://etherscan.io/tx/0x0dd22ed44636e20fa6f09b51dad9894dd9c9e3fd0636c05ac7d222a35fa4154c).
    

In the graph above you can see a ring of wallets that transfer the Beeples via zero-value X2Y2 swaps or direct NFT transfers. Multiple wallets are also directly linked via ETH transfers (of 2.1 and 0.03 ETH). It’s a closed loop from the Beeples being purchased by [Doge\_Doge](https://opensea.io/Doge_Doge) moving through a series of wallets that are linked to each other via direct transfers and ultimately arriving in Sotheby’s wallet.

The recovery of the assets I can’t comment on as it happens off-chain. However [TheArtchitech](https://TheArtchitech) was likely fortunate the stolen Beeples ended up in Sotheby’s auction wallet rather than being sold.

[https://x.com/beeple/status/1796234140708192641](https://x.com/beeple/status/1796234140708192641)

When you look at the people the [TheArtchitech](https://TheArtchitech) thanked there’s some clues to what might have happened off-chain.

[https://x.com/ARTMAN141/status/1796238278598754462](https://x.com/ARTMAN141/status/1796238278598754462)

On May 29th 2024 (5 months after the attack) all three of the stolen Beeples were transferred from the Sotheby’s auction wallet [0x55eca4d1c9ea7021509a7cd88c68c279dabdd37d](https://etherscan.io/address/0x55eca4d1c9ea7021509a7cd88c68c279dabdd37d) to [TheArtchitech](https://TheArtchitech)’s new wallet [0x0c260590C474D8D7A9b1D911454E30BFeAFb4eA7](https://etherscan.io/address/0x0c260590C474D8D7A9b1D911454E30BFeAFb4eA7) in this [transaction](https://etherscan.io/tx/0x0fee4beb23d31ca9b3342a208455ab80f219d2a3a4c034845f365f6fa0a24bb5).

I suppose whatever happens off-chain stays off-chain….

---

*Originally published on [radicalnotions.eth](https://paragraph.com/@radicalnotions/the-artchitech-s-stolen-beeples)*