Evaluating & Avoiding NFT Scams

What you'll learn

• The Real Scam Landscape
• Named Rug Pulls — Frosties and Evolved Apes
• Wallet Drainers — The Modern Scam at Scale
• Celebrity Promotions and SEC Enforcement
• How to Evaluate an NFT Project Before Buying
• Wallet Hygiene and Practical Defense
• What to Do If You Are Scammed

Key terms

Rug pull

A scam where project creators collect mint or token-sale revenue and abandon the project. Notable prosecuted examples: Frosties ($1.1M, January 2022, Llacuna and Nguyen charged March 2022, Nguyen sentenced ~5 years in 2023) and Evolved Apes ($2.7M / 798 ETH, September-October 2021, three UK nationals charged June 2024).

Wallet drainer

Phishing-as-a-service software that steals funds after a victim signs a malicious approval. Combined drainer activity stole approximately $494M from 300,000+ addresses in 2024 (Chainalysis). Major brands include Inferno (~40-45% market share), Pink Drainer (announced exit May 2024), and Angel Drainer.

Address poisoning

A scam where an attacker sends dust transactions from a vanity address visually similar to addresses the victim has used, hoping the victim copies the wrong address from their transaction history. The May 2024 wBTC incident drained $68M; most was eventually recovered.

Phishing

Fraudulent attempts to steal wallet credentials or trick users into signing malicious transactions, typically via fake websites, hijacked verified social accounts, or impersonated DMs.

setApprovalForAll

An ERC-721 / ERC-1155 function that grants a contract permission to transfer ALL of a wallet's tokens in a given collection. The canonical drainer attack vector — if a transaction calls this on an unfamiliar contract, do not sign it.

Token approval (allowance)

Permission granted to a smart contract to move tokens or NFTs on a wallet's behalf. Required for marketplace activity but should be reviewed and revoked periodically (use revoke.cash).

Wash trading

Buying and selling an NFT to oneself across multiple wallets to inflate apparent volume and prices. Major contributor to LooksRare and X2Y2 volume in 2022 before those marketplaces became inactive.

Doxxed

A team or individual whose real identity is publicly known. Doxxed teams are generally lower-risk because they have legal and reputational accountability — though doxxing is no guarantee of legitimacy.

SEC anti-touting rules

Federal securities provisions requiring promoters to disclose any compensation received for promoting securities. Kim Kardashian settled for $1.26M total ($260K disgorgement + $1M penalty) on October 3, 2022 for failure to disclose paid EthereumMax promotion. Floyd Mayweather and DJ Khaled were the first ICO-touting cases (November 29, 2018, Centra Tech).

Recovery scam

A secondary scam targeting recent victims, typically promising to recover stolen funds for an upfront fee. Always fraudulent — legitimate recovery works through law enforcement, never direct payment.

DYOR

"Do Your Own Research." A common crypto motto emphasizing personal due diligence before any investment. Not a substitute for actual research, but a useful reminder that no influencer's endorsement replaces your own contract review and project evaluation.

Chainalysis Crypto Crime Report

An annual report published by blockchain analytics firm Chainalysis tracking on-chain illicit activity. The 2024 report quantified drainer losses at ~$494M across 300,000+ victim addresses and is the most-cited source on the scale of crypto-related theft.