The Kiss exploit analysis

On a single day in early June 2026, every remaining Klimt NFT certificate held by the Belvedere Museum in Vienna was transferred from the museum's wallet without authorization. Of the 10,000 certificates the museum had issued in 2021 representing postage-stamp-sized sections of Gustav Klimt's *The Kiss*, only about a quarter had ever sold; the other 7,200 sat in the museum's wallet until the drain.

What was taken

At the certificates' sale price the stolen NFTs would have been worth around €13.32 million (US$15.3 million). The realized value is much lower: the museum had been unable to move the inventory at its listed price for several years, and the museum quickly unlinked the image files from the digital assets, after which OpenSea blocked the certificates from trading. The result is an asset that is technically still on-chain but commercially worthless to anyone who acquired it without authorization.

The mechanism is undisclosed

The museum described the event only as "transferred from the wallet without authorization." No post-mortem has been published, and the Der Standard report does not name the wallet software, the chain, or the contract address. The 2021 NFT sale was a small, museum-controlled issue rather than a typical third-party mint, so the venue of the drain is not obvious from the public record. The mechanism is not disclosed.

Where it sits in the corpus

A non-crypto heist of art-backed NFTs is unusual. The incident does share one feature with most of the 2026 NFT-side losses: a custodial wallet, owned by a single party and protected by whatever software the party chose, was the only line of defense. The same shape is visible in the jaredfromsubway case, where a single bot operator's approval logic was the only thing standing between the funds and an attacker, and in Humanity Protocol, where one laptop held multiple bridge multisig keys. Where the asset is held by a single custodian rather than a smart contract, the security of the asset is the security of that custodian's machine.