The scams, and how each one actually works

Being told “watch out for scams” is useless advice. Everyone knows scams exist, and people are still caught, because the warning does not tell you what the attack actually looks like in the ten seconds before it succeeds.

So this page is mechanical. For each attack: what the attacker is doing, why it works, and the one signal that gives it away.

The common thread is worth stating at the top. Almost none of these involve breaking anything. The blockchain is not compromised, the wallet software is not broken, no password is cracked. In nearly every case, the victim authorises the loss. The attack is on judgement under time pressure, not on cryptography.

1. Signature phishing

The most common attack by a wide margin.

How it works. You reach a page — via a Discord message, a reply on social media, a sponsored search result, a fake airdrop notification. It looks like a marketplace, a mint page, or a wallet-verification step. It asks you to connect your wallet, then to sign something described as routine: “verify ownership”, “connect”, “claim”.

The signature is not routine. Depending on the variant, it grants setApprovalForAll over your collection, or it authorises an off-chain order that transfers a token to the attacker. Because you signed it, the transfer is entirely valid. Nothing was broken.

Why it works. Signature requests are frequent and mostly harmless, so people stop reading them. The malicious one arrives inside a normal-looking flow at a moment when you are focused on the thing you came to do.

The signal. A permission request wider than the action you are performing. You are claiming a free item; why does it need approval over your entire collection? You are connecting a wallet; why is there a signature at all? Legitimate actions request the narrowest permission that accomplishes them.

Defence. Read every signature request. Reach sites by typing the URL. Keep valuable assets in a wallet that connects to nothing.

2. Counterfeit collections

How it works. Anyone can deploy a contract and copy a real collection’s name, artwork and description. The listing looks identical, because the images are the originals. It appears in search results. It is priced attractively below the real floor.

You buy it. You own a real token from a worthless contract.

Why it works. Everything a buyer normally uses to judge — visuals, name, description — is trivially copyable. The one thing that is not copyable is the part nobody checks.

The signal. A price meaningfully below the collection’s usual range. Genuine items do not sit far below floor in a liquid collection; someone would have taken them. A bargain here is the most reliable counterfeit indicator there is.

Defence. Check the contract address against the project’s own site or verified account. Not the marketplace’s badge — the contract address. Then check trading history and holder count: a real collection has both, a counterfeit has neither.

3. Fake mint pages

How it works. A project announces a mint. Attackers register similar domains and push them through paid search, compromised Discord accounts and reply spam — often minutes before the real mint, when everyone is watching for a link.

The page is a copy of the real one. Connecting and minting sends funds to the attacker, and often requests approvals on the way.

Why it works. Mints are time-pressured by design. Scarcity and countdowns exist precisely to make people move fast, and moving fast is when verification gets skipped.

The signal. Any urgency you did not create yourself. “Only 50 left”, “closes in three minutes”, “you have been selected”. Urgency is the attack surface.

Defence. Get the mint URL from the project’s own site, in advance, and bookmark it. Never from a link in a message, however plausible the source. Compromised Discord admin accounts posting real-looking announcements is routine.

4. Rug pulls

How it works. A project builds anticipation with a roadmap, mints, collects the proceeds, and then stops. Development ceases, socials go quiet, the team is unreachable. In the harder variants the contract itself contains a function letting the deployer drain funds or mint unlimited supply.

Why it works. It is indistinguishable from a legitimate project before the mint. Both have a Discord, a roadmap, and confident promises. The difference only becomes visible after the money has moved.

The signal. Anonymity plus heavy promises plus no verifiable track record. Any one alone is not damning — plenty of legitimate builders are pseudonymous. All three together is the pattern.

Defence. Look for a shipped history rather than a promised future. Has this team completed anything? Is the contract verified and readable? Is there a genuine product, or only a roadmap? And treat “utility coming soon” as what it is: a promise with no enforcement mechanism.

5. Wash trading and manufactured volume

How it works. Someone trades an asset between wallets they control, generating volume and sale prices that are not real. The collection appears active and appreciating. Retail buyers arrive, buy at inflated prices from the operator, and hold something with no genuine market.

Why it works. Volume and recent sale prices are exactly what most people use to judge whether a collection is alive.

The signal. Volume concentrated among few addresses, with prices that move in a suspiciously clean line. Real markets are messy; manufactured ones often are not.

Defence. Look at distinct holder count rather than volume. Check whether sales involve many different addresses. Be sceptical of any collection whose entire history is a few weeks old.

6. Fake support and “recovery” services

How it works. You post about a problem. Within minutes, several accounts offer help. They direct you to a “support portal” that asks you to connect your wallet or enter your recovery phrase to “restore” it.

The recovery variant is worse: it targets people who have already been robbed, offering to retrieve stolen assets for a fee. The assets are not retrievable. The fee is the point.

Why it works. It arrives at a moment of stress and confusion, when someone needs help and is grateful to be offered it.

The signal. Unsolicited help. Legitimate support does not appear in your mentions within sixty seconds of a problem. And nobody can recover stolen assets — the ability to reverse a transaction does not exist.

Defence. Only ever contact support through the official site. Never enter a recovery phrase anywhere. Accept that stolen assets are gone; the alternative is losing more.

7. Airdropped bait tokens

How it works. An unknown NFT appears in your wallet. Anyone can send you a token. Curiosity leads you to look it up; the linked site asks you to connect and sign to “claim” or “sell” it. The signature is the attack.

Why it works. It exploits the reasonable instinct that something in your wallet is yours to investigate.

The signal. You did not ask for it and do not recognise it.

Defence. Do not interact with unsolicited tokens at all. Hide them. Do not visit any site they reference. Holding one is harmless; interacting with it is the only risk.

The four habits that prevent nearly all of this

1. Type URLs, never click links. Bookmark the sites you use. This alone defeats most phishing.
2. Read every signature. If the permission is wider than the action, stop.
3. Separate your wallets. The wallet that browses should not hold anything valuable.
4. Be suspicious of urgency. Every scam above uses time pressure. A legitimate opportunity survives you taking ten minutes to check.

And the one rule that matters most

No legitimate service will ever ask for your recovery phrase. Not to validate it, not to sync a wallet, not to claim anything, not to fix anything. There is no exception. Every request is theft, without qualification.

If you remember nothing else from this site, remember that sentence.

Next: storing NFTs safely covers the wallet setup that makes most of these attacks structurally unable to reach anything worth taking.