An unfortunate user lost non-fungible tokens (NFTs) worth hundreds of thousands of dollars due to a complex phishing scam in the Blur marketplace. The incident, reported by 0xQuit on X (Twitter), involves the loss of six Bored Ape Yacht Club NFTs, 40 Beanz, and three Elementals—all listed for 1 wei each. Wei is the smallest unit of ETH on the Ethereum blockchain. Based on the minimum prices for each asset, the total amount of the theft is approximately $239,676.
The scam was carried out by an unknown perpetrator who exploited a loophole in Blur’s listing system to enable private sales. According to 0xQuit, a developer and auditor of Solidity, the scammer manipulated the NFT settings to circumvent Blur’s standard policy, which does not support private listings.
Typically, when a perpetrator tricks someone into listing an NFT for almost nothing, automated bots purchase it by paying higher fees, leaving the scammer with nothing. To counter this, perpetrators encourage people to list NFTs at high prices, with all proceeds going to the scammer’s address. They achieve this by creating a rule that nullifies any transaction unless the perpetrator has made the purchase, effectively making the sale private.
Read more:
In recent years, NFT sales have significantly declined. 0xQuit clarified that the scam involved convincing the victim to sign an order on a phishing website, usually through a dummy account on X, advertising a scam or airdrop verification.
In some cases, authorities have tracked down the individuals responsible for large-scale scams. For example, last month, three UK citizens were charged with organizing a $3 million scam related to the NFT collection “Evolutionary Ape” in 2021.
