Marvel NFT partner Veve closes its marketplace after an in-app token exploit

Published at: March 23, 2022

Veve, a nonfungible token (NFT) marketplace with licensed digital collectibles, faced an exploit on Tuesday, resulting in millions of gems (in-app tokens) being acquired illegally. The platform is quite popular among mainstream brands such as Marvel, Pixar, and Coca-Cola, that have chosen Veve as their official launch partner.

In an official tweet published on Wednesday, Veve acknowledged the exploit on its platform and said that the attackers managed to acquire a “large amount” of gems illegitimately. The app-based NFT platform has shut the marketplace along with the gems purchase option until the investigation is complete.

As a result of this exploit, we have closed the Market, Gem purchases and transfers while we investigate. We will update you on the expected timing of Market opening as soon as we can.

— VeVe | Digital Collectibles (@veve_official) March 23, 2022

Gems are the VeVe in-app token that users use to exchange for collectibles during drops or in the Market. Early reports suggest that the exploiters behind the attack managed to mint millions of gems without having to pay for it by exploiting a bug in buying mechanism. One user wrote that their friend accidentally purchased gems using an expired credit card and the transaction went through.

From what I heard someone was informed by their friend they accidentally purchased gems with an expired credit card and the transaction went through anyway. So it sounds more like an expired credit card exploit than stolen credit cards. No confirmation by Veve yet though.

— ⭕ Garlic Shrimp ⭕ (@GARLICxSHRIMP) March 22, 2022

The platform has also restricted several user accounts that reportedly tried buying the cheap gems from fraudulent accounts. While the NFT platfrom didn’t disclose the exact amount of gems that were exploited, a Twitter user has claimed the figure could be in millions and might be the biggest heist on the platform. Veve didn’t respond to Cointelegraph’s requests for comments at the time of publishing.

The Twitter user also shared a timeline of events of the exploit where Veve first registered the largest 3-day buying of the in-app token gems, followed by a crash in the price of the token off app by half, falling from 0.5 to 0.25 and then the marketplace goes into maintenance.

Soooo.... apparently about 7M gems were fraudly purchasedMultiple accounts that interacted with them are now disabled Veve will need to recover those gems and this will be their biggest exploit to date Users that purchased cheap gems off app will likely lose funds https://t.co/7YG3BBXjMe

— niftyswaps.eth ⭕ (@niftyswaps) March 23, 2022

The gem exploits on Veve also resulted in a massive decline in the price of the listed NFTs on the platform, where one user realized why their NFT value plunged by 80% within a week after Veve’s official Twitter post.

@veve_official just saw your latest tweet, now I understand why my secret rare goofy dropped 80% in value from the ATH at Market in a matter of weeks and I panic sold it finally. Very unhappy! 1st BOTS and now Gem exploit???

— joker_del_mar (@jai_sond) March 23, 2022