NFT scams and how to avoid them

Most NFT thefts need your signature. The scammer's job is to get you to sign something in a hurry. This lesson walks through the common scripts and the signature each one is after.

Fake mint sites

A scammer invents a project, or copies a real one, and promotes a "mint" by direct message, email or social media. The site pushes you to hurry: a countdown, a counter showing supply running out, pop-ups of other people minting.

When you click the button, your wallet shows one of three things:

• A plain payment. You send ETH and receive nothing.
• A token approval. You give the site's contract permission to move tokens out of your wallet.
• A request your wallet flags as dangerous. Some wallets show a red warning that you may be handing over control of your assets.

MetaMask's guidance is direct: minting an NFT should cost only ETH, so a mint has no reason to ask for an approval. If your wallet shows a warning, do not sign.

Approval drainers

Lesson 53 explained that listing an NFT uses a function called setApprovalForAll. It lets another contract move every token you hold in a collection.

Scam sites request the same approval while pretending to do something else: claim a reward, verify your wallet, register for a drop. Once you sign, the scammer's contract takes the NFTs whenever it likes. No further signature is needed.

MetaMask's rule of thumb: you should not have to sign this kind of approval to receive anything.

Lesson 37 covers approvals for ordinary tokens. NFTs work the same way.

Counterfeit collections

Anyone can copy a collection's images and create a new contract with the same name. The copies appear in search results next to the real thing, often cheaper.

The name and the pictures prove nothing. The contract address is the only identifier. Take it from the project's official site and compare it before you buy.

Surprise NFTs

An NFT you never asked for appears in your wallet. Its name or description contains a web address and a promise: a prize to claim, a token to redeem.

It is bait. The site will ask for an approval or a signature. Leave the NFT alone. You do not need to remove it, and trying to sell or move it can be the trap.

Rug pulls

A project sells out its mint on the strength of a roadmap: a game, events, a share of future revenue. Then the team stops responding and the money is gone. Lesson 11 covered rug pulls in tokens. NFT projects fail the same way.

Anonymous teams, vague roadmaps and pressure to mint now are the usual signs.

Fake prices

Lesson 53 covered wash trading. A scammer trades an NFT between their own wallets at rising prices, then lists it for you at a "discount".

Habits that stop most of this

• Use a separate wallet for minting and browsing. Keep valuable NFTs and savings in a wallet that never connects to new sites.
• Reach sites from a bookmark or the project's verified profile. Never from a direct message.
• Read the wallet prompt. Ask what it will let the other side do. If you see "approval for all" and you are not listing something for sale, stop.
• Slow down. Urgency is the scam. A real mint that sells out without you has cost you nothing.
• Review and revoke approvals you no longer need.
• Remember what a hardware wallet does not do. It keeps your key offline. It will still sign a bad approval if you press the button.

If you signed something you should not have, Lesson 40 has a response plan. Speed matters.