Yuga Labs

Yuga Labs is a United States-based company primarily known for creating and managing the Bored Ape Yacht Club (BAYC), a prominent collection of non-fungible tokens (NFTs) on the Ethereum blockchain. The organization's core product is this NFT collection, which serves as both a digital asset and a membership token granting access to an exclusive community, along with associated intellectual property rights. Yuga Labs has expanded its portfolio to include other NFT collections such as Mutant Ape Yacht Club (MAYC) and Bored Ape Kennel Club (BAKC), further establishing its footprint in the NFT and broader Web3 space. The company operates within the digital collectibles and blockchain-based membership market, catering to a global audience of crypto-native collectors, enthusiasts, and investors. Its activities encompass the development, sale, and ecosystem management around these digital assets, including licensing and community initiatives.

The organization's operations have been notably impacted by cybersecurity incidents, most prominently a sophisticated attack on April 25, 2022. This incident involved the compromise of the official BAYC Instagram account, which Yuga Labs operates, allowing attackers to post fraudulent links promoting a fake NFT airdrop. The phishing scheme directed users to a malicious website designed to harvest cryptocurrency wallet credentials through a "safeTransferFrom" exploit, leading to the theft of at least 91 high-value NFTs from various collections, including Bored Apes, Mutant Apes, and Kennel Club assets, with reported losses ranging from $2.8 million to over $13 million. This breach followed an earlier compromise of BAYC's Discord server, highlighting a recurring pattern of phishing threats targeting the NFT community. Yuga Labs responded by regaining control of the compromised Instagram account, issuing public warnings against unofficial communications, and initiating investigations with affected victims, while stolen funds were traced to major cryptocurrency exchanges. The incident underscores the persistent security challenges faced by entities managing valuable digital assets and community-facing social media channels.