Concordium Tackles AI Agent Accountability, 0xQuit Helps Rescue $5.7M in NFTs

0xQuit helped recover NFTs worth $5.7 million after a major exploit, spending about 24 hours on the effort and $7,500 in gas, which donations later reimbursed. Speakers also credited him with helping in the NFT Trader exploit and a Flooring Protocol incident involving 29 Apes, four Mutants and several CryptoPunks. In the recent attack, about 40,000 NFTs were affected; one speaker said 20,000 worth more than $6 million were rescued, while roughly 11,000 assets—about 40% of those affected—had been claimed back by the time of the discussion. The figures were presented as estimates, and speakers cautioned that not every asset could be recovered.

A MEV bot front-ran the attack on Weeth, and 0xQuit was among several white hats working to recover assets. Speakers said he set aside other work, built a recovery website and worked through the night for an estimated 26 or 27 hours. One speaker said he first rushed to remove items from his own platform before addressing his own approvals, and described the effort as altruistic. Cirrus’s warning, shared on Discord, may also have helped people protect their assets. A separate hacker wallet sent more than 700 APU NFTs to a Safe wallet as ransom; the host said the hacker appeared to seek 10%, but the negotiation was unclear, and Gia stressed that multiple hackers were involved.

The incident renewed attention to NFT approvals and the responsibility of marketplaces to communicate security risks. 0xQuit’s warning prompted people to revoke approvals, and Plotty Mama said community members who followed her warning reported saving hundreds of NFTs worth thousands of dollars. The host advised owners to claim from the wallet that held the NFT, revoke approvals and move other assets out before connecting to claim; Plotty Mama believed the claim site would block claims until approvals were revoked. James said he felt responsible for not revoking permissions before his losses. Some community members returned NFTs for free, while others asked only to recover costs; speakers estimated about 15,000 people may have been hacked, and some affected users had not yet learned of the incident. A speaker criticized Magic Eden for initially telling users no action was needed when it decommissioned EVM support, saying users should have been warned to revoke approvals. The speaker contrasted that response with Frosty’s, which they said severed a connection and made customers whole, while acknowledging they were not a developer and might not be using technically precise terms.

Boris said Concordium has warned for more than a year that AI agents’ access to applications, money and sensitive information creates accountability risks. Its central argument is that an agent needs a verifiable link to a responsible person or business: without one, it can be difficult to establish who authorized an action, what the agent was allowed to do or who is liable when it fails. The host described a Muse agent that disclosed a user’s home address and accepted a low Facebook Marketplace offer, leading an unexpected stranger to arrive. Speakers framed this as a privacy, safety and accountability failure rather than an exploit, and argued that AI needs more accountability, not simply more intelligence.

Concordium says its identity system is built into the protocol’s base layer, and its agent registry, live since late May or early June, links agents to verified people or businesses. Boris estimated it contained about 3,000 agents at the time of the discussion. The system is intended to work across infrastructure, including Ethereum and Solana, without requiring an agent to migrate; signing keys can be linked to verified Concordium accounts and domains. Boris contrasted this with ERC-8004, which he said provides an identity handle, reputation registry and validation hooks but does not identify who stands behind an agent. Concordium says zero-knowledge proofs can establish facts—such as whether someone is over 18—without disclosing a name, birth date, passport number or other personal data. Speakers cited the EU Digital Services Act, UK Online Safety Act and COPPA as reasons age and identity checks are becoming more important, while warning that stores of identity documents create breach risks.

Boris said Concordium’s registry can support services that verify an agent or its responsible party without necessarily learning the person’s identity, and that an agent’s cryptographic key can be tied to access to someone’s money. Concordium and Boosty Labs were said to have enabled age verification for X402 payment requests, allowing a service to require proof of being over 18 without a passport upload or ID selfie. Boris described fees as predictable, with each verification costing roughly one cent, and transactions as having deterministic finality. He argued that accountable agents could help businesses operate externally rather than keeping them internal, but the speakers also noted that failures can stem from misunderstood instructions, faulty construction or drift. The system does not eliminate those failures; its proposed role is to make authorization and responsibility easier to establish.