The sale you didn't realize you signed

January 2025. A holder in Brooklyn lists three CryptoPunks on Blur for a flash sale. A few days later, a Discord member messages him with an "exclusive collector offer" via a custom signing flow on a "Blur Pro" site. The prompt calls it accepting a bid. What he actually signs is a batch of sell orders: all three Punks at 0.1 ETH each.

The attacker fills the orders instantly. Three Punks at floor of 38 ETH each leave the wallet for 0.1 ETH each. Loss: 113.7 ETH.

Why an off-chain order signature is so dangerous

Blur, like most NFT marketplaces, lets users list and bid by signing off-chain EIP-712 orders, and the marketplace approval you granted when you first listed lets its contract move the NFT once an order is filled. Nothing is broadcast when you sign. A scammer who gets you to sign a sell order at a near-zero price simply fills it from a wallet they control, and the marketplace contract executes it exactly as signed.

The five tells

  • The signing site is not blur.io. "Blur Pro," "Blur Plus," "Blur OTC" are all fake. Listings and bids are managed on blur.io.
  • The price is wildly below floor. Real collectors do not message you offering 0.1 ETH for a 38 ETH NFT.
  • The signature puts your own NFTs up for sale. If the typed-data prompt lists your Punks — or a whole batch of your NFTs — next to a near-zero price, that is the exploit happening live.
  • Urgency on a Discord DM. "Offer expires in 10 minutes" exists to skip the verification step.
  • Discord IDs are spoofed. A scammer can impersonate the Blur team handle with a one-character difference.

The recovery checklist

If you signed: on blur.io, and on any other marketplace where you have listed, use the option to cancel all listings and offers. It costs gas, and it invalidates orders you have already signed. At the same time, move every NFT in the affected wallet to a fresh wallet, then revoke the old wallet's marketplace approvals on revoke.cash. Do not sign anything else until you understand what you signed.

The standing posture

Treat every NFT marketplace signature like a contract you are about to sign in real life: read it, name the counterparty, name the price, name the duration. If any of those three blanks are unfilled, refuse.