NFT scams are designed to trick you into signing a malicious transaction or connecting your wallet to a fake site. They range from simple copycat collections to sophisticated phishing dApps that drain everything.
Types of NFT Scams
1. Fake Mint Links
Scammers post “free mint” links in Discord, Twitter, and Telegram. The link leads to a fake minting site that asks you to “verify your wallet” — by signing a transaction that gives them unlimited spending approval on your NFTs.
How to spot:
- URL is similar but slightly different from the real project
- “Free mint” with high expected value
- Countdown timer creating urgency
- The site asks you to “verify” by signing a transaction
2. Copycat Collections
Scammers create NFT collections that look identical to popular projects (Bored Ape, Pudgy Penguins, etc.) and list them on marketplaces with confusing names.
How to spot:
- Check the contract address on the project’s official website or Discord
- Use OpenSea’s “verified” checkmark (blue check)
- Low volume and floor price compared to the real collection
3. Fake Marketplace Listings
You find a rare NFT listed at a surprisingly low price. When you try to buy it, the listing is a scam — the NFT on sale is a copycat, not the real one.
How to spot:
- Check the token ID against the official collection
- Verify the contract address (not just the collection name)
- If the price is too good to be true, it’s a fake listing
4. “Floor Sweep” Drainers
A scammer buys a legitimate NFT, then transfers it to a contract that automatically resells it. When you buy the “floor” (cheapest) NFT from this contract, the contract drains your wallet.
How to spot:
- Check the seller’s history — new account with no history
- Verify the collection contract address on Etherscan
5. Social Media Account Takeovers
Scammers hack popular Twitter accounts and post fake mint links to the account’s followers.
How to spot:
- Check if the link matches the project’s official website
- Look for “Account compromised” posts from the real account
- Wait 24 hours before clicking any mint link from social media
The “Signature” Trap
The most dangerous NFT scam doesn’t ask for your seed phrase. It asks you to “sign” a message in your wallet. This signature grants the scammer permission to transfer your NFTs.
Real signatures look like:
- “Sign this message to prove you own this wallet” (SAFE — just a text message)
- “Approve USDC spending limit” (POTENTIALLY DANGEROUS)
Fake signatures look like:
- “Sign to verify your wallet for minting” (SCAM — grants transfer permissions)
- “Set approval for all” in the signature warning
How to Stay Safe
- Use a burner wallet — Create a separate wallet for NFT interactions with minimal funds
- Never visit mint links from DMs — Only use links from the project’s official Twitter/Discord
- Verify contract addresses — Always double-check on the project’s official channels
- Use Revoke.cash — Regularly revoke unnecessary token approvals
- Check the “Is this a scam?” list — On Etherscan, check if an address has been reported as a scam
- Wait before minting popular projects — Scammers target high-demand launches
What to Do If Your NFTs Are Stolen
- Immediately use Revoke.cash to revoke all approvals
- Report to OpenSea/Blur — They may be able to freeze the stolen NFTs
- Report to the blockchain explorer — Mark the scammer’s address
- File a police report — Some jurisdictions treat NFT theft as a crime
Verdict
NFT scams work by tricking your wallet into signing malicious transactions. The defense is simple: never sign a transaction you don’t fully understand, use a burner wallet for NFTs, and always verify contract addresses.
Related: What Is an NFT? Still Relevant? | How to Spot a Fake Wallet | Crypto Wallet Drainers
What matters most
Every NFT scam, however elaborate it looks, funnels toward the same decisive moment: a signed transaction. A fake mint asks you to “verify” your wallet, a copycat collection lures you in with a familiar name, a cheap “floor” listing hides a draining contract — but in each case the actual theft happens when you approve the wrong thing. That is why the single most important habit in this space is refusing to sign anything you do not fully understand. In MetaMask, read the red warnings word for word; if a screen states that a site will be able to spend your tokens and NFTs, that is precisely what it will do. Never sign a signature you cannot explain, and never connect a wallet with meaningful funds to a site you have not verified.
Practical protections to build in
A few low-effort habits block most NFT scams before they reach your main wallet. Keep a dedicated burner wallet with only a small balance and use it for minting and interacting with unfamiliar dApps, so a bad approval cannot reach your savings. Only ever open mint links from the project’s official Twitter or Discord channels, never from a direct message or a forwarded link. Verify the contract address against the project’s official website before buying or claiming anything, and treat a low-volume impostor with a suspiciously cheap floor price as an obvious fake. On marketplaces, check the seller’s history and the verified checkmark, and be wary of new accounts with no record. Finally, make regular revocation part of your routine: use Revoke.cash to clear unused token approvals, and if you do fall for a drain, revoke everything immediately.
When to wait before you mint
High-demand launches are the perfect cover for attackers, who know collectors will rush a countdown timer and skip their checks. For any popular project, consider waiting at least 24 hours before interacting with the mint — long enough for a compromised announcement or a faulty contract to be flagged publicly. A “free mint” with an inflated expected value, an unknown URL, and a fake countdown is playing on your fear of missing out rather than on a real opportunity. The genuine project will still be there tomorrow; the scam’s urgency is the tell that it will not be.
If your NFTs are stolen
If the worst happens, speed is everything. Use Revoke.cash immediately to revoke all outstanding approvals before they can be used again. Report the theft to the marketplace — OpenSea or Blur — which may be able to freeze the stolen NFTs. Flag the scammer’s address on the blockchain explorer so others can see it, and file a police report in jurisdictions where NFT theft is treated as a crime. Not all of this will recover your assets, but every step limits further damage and helps warn the next target.
Common questions
Q: Why is a fake mint link so dangerous even though it never asks for my seed phrase? A: Because it does not need your seed phrase. The fake site asks you to “verify your wallet” by signing a transaction, and that signature grants the scammer approval to transfer your NFTs and tokens. Signing without reading what the transaction does hands over control with no password required.
Q: Can I spot a copycat NFT collection without being an expert? A: Yes, using the contract address rather than the name. Look up the real project’s official site or Discord, compare that contract address to the one on the listing, check for OpenSea’s verified checkmark, and note the volume and floor price. A genuine collection has real trading history; a copycat usually has low volume and an unrealistically cheap floor.
Q: Is it safe to claim an airdrop from a well-known NFT project? A: Only if you confirm it independently. Takeovers happen, and even official-looking accounts can post malicious claim or mint links. Navigate to the project’s official website yourself, verify the contract, and be especially cautious with anything that asks you to sign a transaction to “claim” or “verify.”