Curriculum·G704 Community Moderation·about 32 min

Admin accounts and the privilege ladder

By the end of this lesson you can

→State what happened to the Bored Ape Instagram account in April 2022, what the fake page asked members to sign, and what was taken
→Explain why the account's two-factor authentication did not prevent the compromise, and what that says about which controls protect a privileged account
→Compute what least privilege removes from the surface, by counting the accounts that can post against the accounts that need to
→Design a privilege ladder for a community: who holds what, for how long, with which second factor, and how a role is removed

Graduate · enrolled learners

This lesson opens with The Bored Ape Yacht Club Instagram, 25 April 2022.

What happened: The official Bored Ape Yacht Club Instagram account was taken over and used to post a link to a copy of the project's website advertising a fake airdrop. Members who connected a wallet and signed the transaction the page requested, a safeTransferFrom call, transferred their tokens to the attacker. Reports put the take at 91 NFTs worth about $2.8 million, including four Bored Apes, six Mutant Apes and three Kennel Club tokens, with other estimates near $3 million. Yuga Labs said that two-factor authentication had been enabled on the account and that security around it followed best practices, and that it did not know how the attacker had gained access.
The decision point: Two-factor authentication was on, best practices were followed, and the account was taken anyway; the company said it did not know how. The control that was supposed to protect the account protected the login form, and the attacker did not come through the login form, or came through it with something the second factor did not stop. A privileged account is protected by the weakest of its recovery paths, its session tokens, its connected apps, its phone number and the people at the platform who can reset it, not by the strongest control on its front door. The design that limits the damage is not a better second factor on the one account; it is fewer accounts that can post as the project at all, each held for as short a time as the job needs, so that the one that is taken can do the least.
Recorded loss: $2,800,000

What you will be able to answer

→What happened to the BAYC Instagram in April 2022?
→What protects a privileged account?
→What is the design response to an account that can be taken despite its controls?
→The rungs of the privilege ladder?

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.

Enroll, it is free Sign in Start at the beginning

Terms used here

Phishing

Sources and review

Confidence medium·Volatility medium·Reviewed 2026-09-14·Owner unassigned

Contested

Reported losses range from about $2.4 million to $3 million and token counts vary; the 91-token figure is from on-chain tracing reported by several outlets. The method of compromise was never publicly established, and the lesson's argument depends only on the fact that the front-door control was in place and did not prevent it.

The lesson does not claim two-factor authentication is ineffective. It claims that a privileged account has paths the login-form control does not cover, and that the design must assume any single account can be lost.

← The server is the attack surface Social engineering of the people who hold the keys →