- An NFT collector on Blur NFT has lost 49 collectibles valued at over $200,000 to scammers
- The scammers used sophisticated methods to steal the NFTs despite Blur having measures to prevent such scenarios
- The lost collectibles included six Bored Apes, 40 Beanz, and three Elementals
An NFT collector is counting losses after 49 of their collectibles were maliciously sold on the Blur NFT exchange. The sale was conducted through a sophisticated scheme that allowed the scammers to bypass measures put in by Blur to safeguard users from malicious actors. According to analysts, the scammers were able to initiate a private sale despite it being prohibited by the marketplace, an indication that scammers are expanding their tactics with hopes of netting more victims and funds.
A Loophole on Blur’s Royalty System
Explaining the tactic behind the malicious sales of the NFTs, an X user known as “Quit” said that the scammers must have tricked the collector into signing something on a malicious site before allowing their assets to be listed for sale at a price next to zero or 1 Wei, the smallest ETH unit.
A user just lost 6 BAYC, 40 Beanz, and 3 elementals by bulk listing them for 1 wei each to a scammer on Blur.
See my previous thread on the mechanics: https://t.co/ihWKpshaIT pic.twitter.com/3sLzMES59A
— Quit (@0xQuit) July 3, 2024
Since Blur has measures to prevent NFT prices from being set to or near zero, the malicious actors found a loophole in the platform’s royalty system. The actors added some rules during the listing stating that only they can buy the NFTs.
This tactic allowed them to list the NFTs for low prices and buy the collectibles without competition from other traders and bots.
Pink and Inferno Web3 Wallet Drainers Exit Market
Although the entity behind the sale is unknown, Quit had in a previous post said that Pink Drainer is using an iteration of this tactic. For Pink, it was setting the prices above the floor price and setting “their own address as the royalty recipient with 100% royalties.”
3/ To combat this, we’ve seen scammers phish signatures to list items ABOVE floor, with their own address set as the royalty recipient with 100% royalties.https://t.co/yp38uuDYnQ
— Quit (@0xQuit) June 1, 2023
This comes a month after Pink Drainer announced that it was shutting down. Another web3 wallet drainer, Inferno Drainer, has also announced its exit from the space. The incident also comes three weeks after a UK court charged the creators of the Evolved Apes NFT project for defrauding investors.
Although Blur is yet to acknowledge the incident, it proves that scammers are willing to go the extra length to steal funds.
