Ultra Cat
On November 3, 2026, Ebisu's Bay, the long-standing NFT marketplace of Cronos, was hit by an exploit on its offers service. The team says it switched the service off within 13 minutes of noticing the attack, and that its other products were not affected.
What happened
Early warnings from the community pointed to an attack using gasless transactions combined with offers and listings. The result: 252 NFTs, worth about 53,000 CRO in total, changed hands without their owners' intent. Some holders woke up with NFTs missing, others with extra NFTs and missing CRO.
The refund plan
Ebisu's Bay announced a 100% refund and published the full list of affected NFTs. The plan, shared on November 4:
- Every returned NFT goes back to its rightful owner.
- Every bidder who returns an NFT gets 100% of their bid back in CRO.
- Affected wallets receive an on-site notification; returns and refunds go through a ticket on the Ebisu's Bay Discord.
- Every affected wallet, refund and return is tracked in a public document.
What you should do
- If you use Ebisu's Bay, check your wallet and watch for an on-site notification.
- Remove open offers and listings you no longer need.
- Revoke the approvals you gave to marketplaces and contracts you don't actively use. Our guide How to Revoke Token and NFT Approvals on Cronos shows how.
- Only follow links shared in the official Ebisu's Bay channels: fake "refund" sites usually appear right after an incident.
