Attackers stole hundreds of NFTs from OpenSea users over the course of three hours on Saturday. 254 tokens were stolen, including tokens from Decentraland and Bored Ape Yacht Club. Attack appears to have exploited flexibility in Wyvern Protocol, the open-source standard underlying NFT smart contracts.