EthCC's Non-Transferable NFT Tickets Leave Scalpers $68K Out of Pocket

Conference tickets for crypto events sell out quickly even in bear markets, pushing latecomers toward informal secondary deals. EthCC's ticketing this year showed that cutting corners on those deals — even with MEV-style tricks — can backfire badly.

A group describing themselves as "crypto enthusiasts" found a way to buy up 200 EthCC tickets in bulk with the intent to resell them. When the conference organizers responded by stripping the metadata from the underlying NFTs, the tickets became worthless — leaving the group out $68,000.

Here's how the scheme unfolded.

EthCC's ticketing this year ran on NFTs, with metadata validated by the Unlock Protocol to grant entry. By design, the tickets are non-transferable: any attempt to call the transfer function simply throws an error and reverts.

Tickets went on sale in five batches. The third batch, consisting of 308 tickets, sold out within three minutes on Thursday, March 23rd. Of those, 10 were purchased with credit cards and 98 with USDC — while a single buyer scooped up the remaining 200 using USDC (source).

That concentration is exactly what alarmed the EthCC team. Since the NFTs couldn't legitimately be transferred, the buyer needed a workaround to extract any value from holding so many. The approach: deploy a dedicated Gnosis Safe contract for each ticket, then later transfer ownership of that Safe to effectively hand off the ticket without triggering the non-transferability check.

The flaw in this plan wasn't new — a similar attempt to resell an EthCC ticket for 5 ETH had already failed on OpenSea three months earlier. Undeterred, the scalpers went ahead and even launched an OpenSea collection to list their tickets for resale, viewable and reportable here.

EthCC didn't stop at relying on non-transferability, though. The team took direct action against the scheme by calling the contract's built-in "expireAndRefundFor" function — normally used to process refunds — but passing a refund amount of zero for each affected NFT. In effect, they used the refund mechanism to void the tickets entirely rather than to pay anyone back.

The mechanics of the scalpers' own contract, as described from their side of the story (full account here), involved a custom ERC721 token called "Wrapped EthCC Tickets":

On every mint: It creates a gnosis safe, buys an EthCC ticket from Unlock Protocol and sends it to the gnosis safe. Then it mints an NFT with the tokenId equal to the tokenId of the EthCC ticket NFT.

On burn: The contract transfers ownership of the gnosis safe to the owner of the burnt wrapped NFT

These NFT wrappers are transferable contracts for underlying non-transferrable NFTs, and they are redeemable for the underlying whenever the owner wishes.

The design looked clever on paper, but because it bypassed EthCC's normal sales funnel, the resulting tickets carried no valid registration metadata — meaning venue staff had no way to check them in at the door.

De Tychey versus the touts

Jerome de Tychey, who runs EthCC, reportedly received a string of direct messages from the scalpers pressing their case after the tickets were voided.

EthCC has so far refunded half of the $68,000 — $34,000 — which is where the dispute currently stands. The scalpers argue they're owed the full amount back. EthCC counters that it needs to hold onto the remaining $34,000 to cover VAT and corporate tax obligations tied to the original sale. The organizers also indicated that if it turns out no tax is owed on the sale after all, they'll still keep the $34,000 — but donate it to Gitcoin rather than return it.

Whatever the outcome for the scalpers, the episode is something of a case study in NFT utility: despite an imperfect ticket sales process, the underlying NFT mechanics let EthCC unilaterally disable the fraudulent tickets, protecting the experience of legitimate attendees. EthCC comes out ahead financially, while the buyer — who broke no explicit rule — is out $34,000. In traditional commerce the dispute would likely be settled by clear contract terms; in this corner of web3, the rules are still being written in real time.

Readers can weigh in on whether EthCC should refund the rest via the Rekt Telegram group.