Hbarter

A more detailed follow up: How the Hedera Monkeys were taken on 24 Oct 2026 (times in UTC) The NFTs were taken through the smart contracts of the HMNKY Staking Platform. SentX does not use smart contracts for NFT trading, and none of the transactions below involve SentX. 1. Staking on the HMNKY Staking Platform gave its contracts permission to move ALL your Monkeys To stake, your wallet signed an "approve for all serials" allowance to the platform's staking contracts (v1 0.0.3927013, v2 0.0.6028958). That lets the contract move every Hedera Monkey (0.0.1006183) in your account, including ones you buy later, until you revoke it. The four accounts drained in the transaction being shared each signed and paid for these approvals themselves. None was ever revoked, and all are still active today. v1 approvals: 0.0.2965560 (29 Oct 2023) hashscan.io/mainnet/transact… 0.0.3072337 (3 Nov 2023) hashscan.io/mainnet/transact… 0.0.2199829 (6 Nov 2023) hashscan.io/mainnet/transact… 0.0.2937571 (4 Feb 2024) hashscan.io/mainnet/transact… v2 approvals: 0.0.2965560 (29 May 2024) hashscan.io/mainnet/transact… 0.0.3072337 (28 May 2024) hashscan.io/mainnet/transact… 0.0.2199829 (29 May 2024) hashscan.io/mainnet/transact… 0.0.2937571 (29 May 2024) hashscan.io/mainnet/transact… 2. The HMNKY staking contract has a public function anyone can call The HMNKY Staking Platform's v1 contract (0.0.3927013) is built on an old version of Hedera's standard contract library. That library includes a function, transferFromNFT, with no check on who calls it. Anyone can tell the contract "move NFT X from holder Y to address Z", and the contract does it using the holder's approval from step 1. 3. Timeline 4 Oct: attacker account 0.0.10905046 is created. 22 Oct: a first wave, by a different account using the same function, takes 52 NFTs from HMNKY and Hash Horses holders. 24 Oct, 04:31: the attacker deploys its own contract, 0.0.10931542. 24 Oct, 05:20–15:10: eight test calls and failed attempts. 24 Oct, 15:27–16:45: the main wave, 92 calls to the attacker's contract. 24 Oct, 15:38: one of those calls is this transaction: hashscan.io/mainnet/transact… The attacker's contract calls transferFromNFT on the HMNKY staking contract 40 times, and the staking contract moves 40 Monkeys to the attacker: 24 from 0.0.3072337, 6 from 0.0.2965560, 5 from 0.0.2937571 and 5 from 0.0.2199829. HashScan marks every transfer as approved, meaning it used an allowance, and the call trace shows the HMNKY staking contract 0.0.3927013 calling the Hedera token service. At the time of writing, the attacker's account holds 2,597 NFTs, all moved in on 24 Oct, including 1,149 Hedera Monkeys, 480 HashPack x HMNKY, 129 Banana Peel HMNKY, 63 Early Monkeys and 763 from The Crypto Show collections: hashscan.io/mainnet/account/… 4. Why "I had no allowances" Many wallets don't show all-serials NFT allowances given to a contract, or people don't recognise the staking approval as an allowance. They show on your account page on HashScan, under the Allowances tab. You can also see the raw data here (swap in your account ID): mainnet-public.mirrornode.he… 5. What to do now Revoke every all-serials allowance you gave to the HMNKY Staking Platform contracts 0.0.3927013 and 0.0.6028958, for every HMNKY collection. Until you do, anyone can use these contracts to take your NFTs, and nobody needs your signature to do it.