Evaluating & Avoiding NFT Scams

Learn from named, prosecuted scams to recognize how NFT fraud actually works in practice — rug pulls, phishing drainers, address poisoning, celebrity-promoted tokens, and the SEC enforcement actions you should know about.

17 min · intermediate · part of NFTs & Digital Collectibles

The Real Scam Landscape

The NFT and crypto-asset space has, unfortunately, attracted serious volumes of fraud. Understanding what has actually happened — with names, dollar figures, and prosecutions — is far more useful than abstract warnings, because real cases reveal the actual patterns scammers use. According to **Chainalysis's 2024 Crypto Crime Report**, total amounts stolen via **wallet drainers** reached approximately **$494 million in 2024 alone**, targeting more than **300,000 unique addresses**. Drainer activity is now the single largest category of NFT-adjacent theft, far surpassing the rug-pull losses that dominated 2021-2022 headlines. The good news is that the patterns are surprisingly stable. Once you have seen ten major rug pulls or drainer campaigns, the eleventh feels familiar. Scammers reuse playbooks because the playbooks work. Education does not eliminate risk, but it cuts losses dramatically — most scam victims will tell you, in retrospect, that they ignored at least two or three warning signs they could have caught. The goal of this lesson is not to make you afraid of the NFT space. There are real artists, real communities, and real legitimate use cases worth participating in. The goal is to give you a concrete, named, dated catalog of what fraud has actually looked like — so when the next variant lands in your DMs, you recognize it before you sign.

Also in this lesson

Named Rug Pulls — Frosties and Evolved Apes
Wallet Drainers — The Modern Scam at Scale
Celebrity Promotions and SEC Enforcement
How to Evaluate an NFT Project Before Buying
Wallet Hygiene and Practical Defense
What to Do If You Are Scammed

Key terms

Rug pull: A scam where project creators collect mint or token-sale revenue and abandon the project. Notable prosecuted examples: Frosties ($1.1M, January 2022, Llacuna and Nguyen charged March 2022, Nguyen sentenced ~5 years in 2023) and Evolved Apes ($2.7M / 798 ETH, September-October 2021, three UK nationals charged June 2024).
Wallet drainer: Phishing-as-a-service software that steals funds after a victim signs a malicious approval. Combined drainer activity stole approximately $494M from 300,000+ addresses in 2024 (Chainalysis). Major brands include Inferno (~40-45% market share), Pink Drainer (announced exit May 2024), and Angel Drainer.
Address poisoning: A scam where an attacker sends dust transactions from a vanity address visually similar to addresses the victim has used, hoping the victim copies the wrong address from their transaction history. The May 2024 wBTC incident drained $68M; most was eventually recovered.
Phishing: Fraudulent attempts to steal wallet credentials or trick users into signing malicious transactions, typically via fake websites, hijacked verified social accounts, or impersonated DMs.
setApprovalForAll: An ERC-721 / ERC-1155 function that grants a contract permission to transfer ALL of a wallet's tokens in a given collection. The canonical drainer attack vector — if a transaction calls this on an unfamiliar contract, do not sign it.
Token approval (allowance): Permission granted to a smart contract to move tokens or NFTs on a wallet's behalf. Required for marketplace activity but should be reviewed and revoked periodically (use revoke.cash).
Wash trading: Buying and selling an NFT to oneself across multiple wallets to inflate apparent volume and prices. Major contributor to LooksRare and X2Y2 volume in 2022 before those marketplaces became inactive.
Doxxed: A team or individual whose real identity is publicly known. Doxxed teams are generally lower-risk because they have legal and reputational accountability — though doxxing is no guarantee of legitimacy.
SEC anti-touting rules: Federal securities provisions requiring promoters to disclose any compensation received for promoting securities. Kim Kardashian settled for $1.26M total ($260K disgorgement + $1M penalty) on October 3, 2022 for failure to disclose paid EthereumMax promotion. Floyd Mayweather and DJ Khaled were the first ICO-touting cases (November 29, 2018, Centra Tech).
Recovery scam: A secondary scam targeting recent victims, typically promising to recover stolen funds for an upfront fee. Always fraudulent — legitimate recovery works through law enforcement, never direct payment.
DYOR: "Do Your Own Research." A common crypto motto emphasizing personal due diligence before any investment. Not a substitute for actual research, but a useful reminder that no influencer's endorsement replaces your own contract review and project evaluation.
Chainalysis Crypto Crime Report: An annual report published by blockchain analytics firm Chainalysis tracking on-chain illicit activity. The 2024 report quantified drainer losses at ~$494M across 300,000+ victim addresses and is the most-cited source on the scale of crypto-related theft.

Continue this lesson — 6 more sections in the CryptoBipto app.

Open lesson

Educational only — not financial advice.