Immunefi collected their data by scanning OpenSea for Bored Apes that have been flagged for suspicious activity as well as combing through social media for claims of theft that were then investigated using blockchain analyses. They looked for suspicious activity dating back to the founding of the collection until they finalized the report in early August 2022.
Because Yuga Labs grants IP rights to holders of a Bored Ape, the IP is essentially lost to the hackers and granted to whoever buys the stolen goods later—whether intentionally or not. In fact, in May, comedian Seth Green “These days, the marketplaces are not in control,” said Alejandro Muñoz-McDonald, a software engineer at Immunefi, told ARTnews. “People can still transfer [stolen assets] to another account and sell them on decentralized marketplaces where blacklisting features aren’t available.”