A non fungible token, generally shortened to NFT, is a blockchain record representing ownership of a specific digital or sometimes physical item. The technology itself is neutral, but the market built around it has attracted a disproportionate amount of fraud, in part because minting a new token is fast, cheap, and requires no verification that the creator actually owns the artwork, brand, or content being tokenized. One major marketplace has publicly stated that more than 80 percent of items created through its free minting tool were fake, plagiarized, or spam, which gives a sense of how much of the visible activity in this space is not what it appears to be.
Rug Pulls
A rug pull is a project that raises money through a mint or presale, builds an active looking community around a roadmap of future features, and then disappears once enough funds have been collected. Some rug pulls are simple abandonment, the team stops responding and the promised roadmap never materializes. Others are built into the smart contract itself, with hidden functions that let the developers drain a project treasury or disable trading entirely once they choose to exit.
Warning Signs of a Rug Pull
- An anonymous team with no verifiable history in any previous project
- A roadmap heavy on future promises and light on anything already delivered
- Aggressive presale or mint pricing designed to maximize funds collected before launch
- No independent audit of the underlying smart contract
- Sudden social media silence or account deletion after a successful mint
A Documented Rug Pull Prosecution
In March 2022, federal prosecutors in the Southern District of New York charged two individuals over an NFT project called Frosties, accusing them of running a rug pull that raised approximately 1.1 million dollars through a presale in January 2022. According to the Department of Justice, shortly after the presale closed, the operators moved the raised funds through a series of separate cryptocurrency wallets, deleted the project's website, and disappeared from social media, cutting off the community that had just funded them. Both defendants were charged with conspiracy to commit wire fraud and conspiracy to commit money laundering. Investigators noted the pair were already preparing the presale for a second NFT project at the time charges were filed, illustrating how quickly an operator can move from one rug pull to the next once the first is complete. The case is one of the clearer examples of how the pattern described above plays out in practice, and how it has been prosecuted when investigators are able to trace the funds.
Fake and Counterfeit Collections
Because minting requires no ownership verification, scammers routinely tokenize art, photography, or entire collections that belong to someone else, then list the counterfeit token for sale as though it were the genuine, original item. Buyers who do not check a collection's verified status or compare it against the original creator's own channels can end up paying real money for a token with no connection to the work it claims to represent.
Wash Trading
Wash trading involves an operator secretly controlling multiple wallets and repeatedly selling a token back and forth between them. This manufactures an inflated trading history and an appearance of real demand, which can convince an outside buyer that a collection is more popular and valuable than it actually is. This tactic is difficult to detect from a marketplace listing alone, since the transactions are genuinely recorded on chain, they simply do not reflect any real, independent buyer.
Phishing and Wallet Draining Links
Perhaps the most financially damaging category involves fake websites, direct messages, or compromised social media accounts that trick a user into connecting their wallet to a malicious contract or approving a transaction that grants broad spending permission over the wallet's contents. A single approved malicious transaction can be enough to drain an entire wallet, not just the NFT that was supposedly being claimed or purchased. These links are frequently promoted through hacked accounts on social platforms or through urgent sounding limited time offers designed to short circuit careful review. The mechanics overlap closely with malicious token approval attacks more broadly, since NFT phishing is simply one common delivery route for that underlying technique.
Never connect your wallet to a site you were directed to through an unsolicited message, and always verify a mint link through a project's official channel rather than a link sent directly to you.
Cloned Marketplace Sites
Beyond fake individual collections, scammers sometimes clone the entire look of a well known NFT marketplace on a lookalike domain, copying its layout, listings, and even real collection images pulled from the genuine site. A visitor who arrives through a search advertisement or a shared link rather than a bookmark can browse what appears to be an authentic marketplace, select a real, desirable NFT, and complete a purchase that sends funds directly to the scammer rather than the actual owner, with no NFT ever transferring to the buyer. Because the underlying listings are copied from a real marketplace, the prices and images look entirely plausible, which is what makes this version of the scam effective against buyers who would normally recognize an obviously fake listing.
The defense here is the same discipline that protects against fake exchanges more generally, reach a marketplace only by typing its address directly or using a saved bookmark, and check the domain carefully before connecting a wallet or entering payment details, since a cloned interface can be visually indistinguishable from the real one.
Fake Giveaways and Impersonation
Scammers frequently impersonate a legitimate project's founder or official account, announcing a surprise giveaway or airdrop that requires connecting a wallet or sending a small amount of cryptocurrency to receive a larger reward in return. No legitimate giveaway requires a payment or wallet connection to claim a reward that is genuinely free.
Verifying a Mint Before You Connect a Wallet
Confirm the Link Through an Official Channel
Before connecting a wallet to any mint page, navigate to it only through a link posted on the project's verified official website or verified social account, ideally one you reach by typing the address yourself rather than clicking a link sent in a direct message or a comment. Scammers routinely post fake mint links in the comments of a legitimate project's own announcement, timed to appear during the excitement of a real launch, counting on people to click the first link they see rather than checking whether it actually came from the project.
Read the Transaction Before You Approve It
When a wallet prompts for approval, read what is actually being requested rather than clicking through automatically. A genuine mint transaction typically requests a specific, limited action, such as paying a set mint price for a set number of tokens. A request that asks for broad, unlimited approval over an entire token or NFT collection in your wallet is not a normal minting request, and approving it can expose far more than the single item you intended to acquire.
Use a Separate, Low Balance Wallet for New Mints
Many experienced collectors keep a separate wallet holding only a small amount of funds specifically for interacting with new or unverified mint pages, rather than connecting their main wallet where higher value holdings sit. This limits the damage a malicious contract can do even if a mint turns out to be fraudulent, since there is little of value in that wallet for a drainer to reach.
- Navigate to mint pages only through a project's verified official website or social account, not a link from a comment or direct message
- Read exactly what a wallet approval request is asking for before confirming, and reject broad or unlimited spending approvals
- Use a separate wallet with a small balance for interacting with new or unverified mints
- Be skeptical of a mint link posted in the comments of a real project's own announcement, since this is a common placement for fake links
- Treat any countdown timer or claimed limited supply as a pressure tactic rather than a reason to skip verification
Protecting Yourself as a Buyer
Verify a collection through the project's own official website and social accounts rather than trusting a search result or a link received directly, check whether the collection carries a verification badge on the marketplace, and research the team's history before participating in a mint. Ignore urgency tactics such as countdown timers, since they exist specifically to discourage the kind of careful checking that would otherwise catch most of these scams.
If you have already connected a wallet to a suspicious site or approved a transaction you now regret, revoke that approval as quickly as possible using a reputable token approval checker, since an unrevoked approval can be used to drain additional assets from the wallet at any later point, not just at the moment it was granted. Our guide on how to revoke a token approval walks through this process for the most common wallets and chains, and it is worth doing even if nothing appears to have been taken yet, since a dormant malicious approval can be exercised at any time in the future.
Creators listing their own work are exposed to a related but distinct risk, having their art or brand tokenized and sold by someone else without permission. Periodically searching marketplaces for your own name, brand, or distinctive artwork is a reasonable habit for anyone who publishes creative or branded content publicly, since counterfeit listings are often reported and removed once flagged directly to the marketplace, but only if someone notices they exist.
Frequently asked questions
Very common by some measures. One major marketplace has stated publicly that over 80 percent of items minted through its free minting tool were fake, plagiarized, or spam, and NFT related fraud losses have been estimated at more than 100 million dollars in a single recent year according to consumer complaint data.
A rug pull is an NFT or crypto project that raises funds through a mint or presale, builds a community around promised future features, and then abandons the project or drains its funds once enough money has been collected. Some rug pulls involve hidden functions built directly into the smart contract to enable this exit.
Reputable, well established marketplaces are generally safe to connect a wallet to for normal browsing and purchasing. The risk comes from connecting to unfamiliar sites reached through unsolicited links, since a malicious site can request a spending approval that goes far beyond the single NFT you intended to interact with.
Check for a verification badge on established marketplaces, confirm the collection is linked from the creator's own official website or verified social accounts, and search for the project name alongside terms like scam or rug pull before buying, particularly for anything promoted through an unsolicited message.
Yes. In March 2022, federal prosecutors charged two individuals over the Frosties NFT project, accusing them of raising approximately 1.1 million dollars in a presale and then moving the funds through separate wallets and disappearing, a classic rug pull. Both were charged with conspiracy to commit wire fraud and money laundering, showing that these schemes can be prosecuted when funds are traced and identified in time.
Sources and further reading
- More Than 80% of NFTs Created for Free on OpenSea Are Fraud or Spam, Company Says · Vice
- 9 common NFT scams and how to avoid them · Norton
- What are some common web3 scams? · OpenSea Help Center
- Two Individuals Charged In Non-Fungible Token ('NFT') Fraud And Money Laundering Scheme · U.S. Attorney's Office, Southern District of New York