Common Scams in the NFT Industry and Prevention Strategies

The cryptocurrency space is fraught with various potential risks, and incidents of asset theft occur frequently, even well-known projects and industry leaders are not immune. For example, Kevin Rose, the founder of the NFT project Moonbirds, suffered a hacking attack in January this year, losing 25 Chromie Squiggles and several other NFTs.

With the increase in NFT theft cases and the amount of losses, it is necessary for us to outline common types of scams and their prevention methods.

Types of NFT Scams

As the scale of the NFT market continues to expand, various new types of scams are emerging one after another.

1. False advertising link

Recently, a cryptocurrency opinion leader suffered a serious hacking attack, resulting in the theft of their social media accounts, email, and crypto wallet, losing all of their crypto assets and NFT. Post-incident analysis revealed that the attack originated from incorrectly configuring the hardware wallet on a new device and clicking on an advertisement link in the search engine to download malware. This highlights the risk that search engine advertising systems may be misused for scams.

2. Inductive Airdrop

A new type of scam involves using high-priced purchases of airdropped NFTs as bait. After victims receive unknown NFT airdrops, the scammers will offer to buy them at a high price. When users attempt to trade, they encounter deliberately designed error messages that lead them to phishing websites and authorize, ultimately resulting in asset theft.

3. Counterfeit NFT

There are quite a few scammers who deceive buyers by stealing artists' works and uploading counterfeit versions on NFT markets. Some scams even create counterfeit projects on trading platforms with names similar to well-known projects and forge transaction records to confuse users.

4. Phishing Email

During a smart contract upgrade on a well-known NFT trading platform, hackers impersonated the official team and sent upgrade notification emails, luring users to click on phishing links and grant permissions, resulting in the theft of assets from multiple popular NFT projects. As many NFT projects require users to bind their email addresses to receive information, this has also made emails a major target for scams.

5. Official account is stolen or forged

The official accounts of NFT projects can sometimes be hacked due to employee operational errors or insufficient security measures. For example, the social media account of a well-known NFT project was once exploited by hackers to publish false airdrop information, resulting in significant losses. In addition, scammers may also forge official accounts and send phishing website links to lure users into signing authorization.

6. Similar Address Deception

Attackers exploit users' habit of only checking a few digits before and after the contract address, forging similar addresses and frequently sending small amounts of tokens to mislead users into thinking it is a trustworthy address. Additionally, users should be alert to zero-transfer on-chain address poisoning attacks.

Asset Protection Recommendations

Given the irreversibility of on-chain operations, prevention is far more important than recovering stolen assets. Here are some key recommendations for protecting your assets:

1. Safeguard your private keys and mnemonic phrases properly, and never disclose them to anyone.

2. Save commonly used official websites and carefully identify official social media accounts to avoid clicking on suspicious links.

3. Adopt a multi-wallet strategy to isolate main assets and regularly check wallet authorization status.

4. Conduct thorough due diligence before participating in NFT projects, cross-verify information through multiple channels.

5. Carefully verify the complete address when making a transfer, and try to use the wallet's address book feature.

If you unfortunately encounter asset theft, you should immediately take the following measures:

• Isolate remaining assets
• Change the passwords for relevant social media accounts
• Disconnect the network connection of potentially infected devices.
• Consider seeking assistance from a professional security company to trace the funds.

With the continuous advancement of technology, scam tactics are also evolving. Staying vigilant, learning new knowledge, and regularly updating security measures are crucial for protecting your digital assets.