Knowing how to spot NFT scams is one of the most valuable skills in Web3, because once your wallet is drained, there is usually no refund and no chargeback. NFT scams come in predictable shapes: fake mint websites, phishing links, rug pulls, impersonator support DMs, and malicious transaction approvals that you sign without realizing what you are agreeing to. The good news is that nearly all of them rely on the same handful of tricks. This guide walks through the most common NFT scams in 2026, the red flags that give them away, and the concrete habits that keep your assets safe.
For the bigger picture, see the NFT hub: it compares the options and points to the next guide to read.
Key takeaways
- Most NFT scams exploit urgency, impersonation, and your willingness to sign transactions you don’t fully read.
- Never enter your seed phrase anywhere; no legitimate mint, support agent, or app will ever ask for it.
- Malicious “approvals” and blind signing can drain a wallet without stealing your seed phrase at all.
- Verify collections, links, and team identities independently before connecting your wallet.
- A hardware wallet and a separate “burner” wallet dramatically reduce your exposure.
Why NFT Scams Work So Well
NFT scams thrive on three psychological levers. First, urgency: “mint closes in 5 minutes” or “only 50 spots left” pushes you to act before you think. Second, impersonation: scammers copy the names, logos, and even verified-looking accounts of trusted projects. Third, complexity: signing a blockchain transaction is confusing, so people approve things they don’t understand.
The same levers appear in much larger frauds, as our look at the largest crypto scams and collapses shows.
Crucially, many NFT scams never need your password or seed phrase. They trick you into authorizing a transaction that hands over your assets. Because you clicked “confirm” yourself, the theft looks like a normal, voluntary action on-chain. Understanding this is the foundation of staying safe.
The Most Common NFT Scams in 2026
Fake mint websites
A fake mint is a website that imitates a real or fabricated NFT drop. You connect your wallet expecting to mint a new NFT, but the “mint” button actually triggers a transaction that transfers your funds or approves a malicious contract. Scammers promote these through hacked social accounts, paid ads, and fake links in comment sections.
Red flags: URLs with subtle misspellings (a swapped letter, an extra hyphen, a wrong domain extension), links shared only via DM or comments rather than the project’s official pinned channels, and “mints” that appear suddenly with heavy countdown pressure.
Phishing links
Phishing aims to capture your credentials or push you to a malicious signing page. The link might arrive by email, Discord, X (Twitter), or even a comment under a legitimate post. It often leads to a clone of a well-known marketplace or wallet site that asks you to “verify,” “validate,” or “re-sync” your wallet.
Red flags: any page asking for your seed phrase or private key, unexpected “your wallet needs verification” prompts, and shortened or obfuscated URLs. Bookmark official sites and only navigate there directly.
Rug pulls
A rug pull is when a project’s team raises money through a mint or token, then abandons the project and disappears with the funds, leaving holders with worthless assets. NFT rug pulls often involve anonymous teams, big promises of utility or roadmaps that never materialize, and a sudden deletion of social channels. Learn the full pattern in our guide to what a rug pull is.
Red flags: fully anonymous team with no track record, guaranteed returns or “floor will only go up” promises, roadmap hype with no working product, and pressure to buy immediately. Rug pulls are part of a broader family of crypto scams worth studying before you invest.
Fake support DMs and impersonators
You post a question in a public channel, and within minutes a “support agent,” “mod,” or “team member” direct-messages you offering help. They are almost always a scammer. They may send you to a fake support portal, ask you to “validate” your wallet, or request your seed phrase outright.
Red flags: unsolicited DMs offering help (legitimate teams rarely DM first), anyone claiming official support needs your seed phrase or wants you to share your screen, and accounts with slightly altered usernames mimicking real team members.
Malicious approvals and blind signing
This is the most technical and most dangerous category. When you interact with NFT marketplaces, you grant smart contracts permission to move your tokens or NFTs. A malicious contract can request a broad approval, such as permission to transfer all NFTs in a collection, or a token spending allowance with no limit. Once granted, the scammer can drain those assets at any time later, even days after you signed.
“Blind signing” makes this worse. Some signature requests are unreadable hashes rather than plain-language descriptions, so you approve something without knowing what it does. Scammers exploit this with deceptive signature requests that look harmless.
Red flags: a signing request that asks to approve all assets or grants unlimited spending, signature prompts you can’t read or understand, and any transaction that doesn’t match what you intended to do. When in doubt, reject and investigate.
Counterfeit collections
Scammers copy the artwork and name of a popular collection and list these fakes on marketplaces. Buyers think they are getting the real thing at a discount. The fake NFT is worthless because it is not from the verified contract.
Red flags: a “deal” priced far below the real collection’s floor, missing verification badges, and a contract address that doesn’t match the official one. Always confirm the contract address from the project’s official source before buying.
Unsolicited airdropped NFTs (on-chain scam NFTs)
An on-chain NFT scam often starts with an NFT you never asked for. Scammers airdrop free NFTs or “voucher” tokens to thousands of wallets, with names or images promising a reward: “claim 5 ETH,” “you’re eligible,” a fake ticket. The NFT itself can’t hurt you just by sitting in your wallet. The danger is the link in its name, image or description, which leads to a drainer site that asks you to connect and sign. Some airdrops are designed so that trying to sell or transfer the NFT on an unfamiliar site is the trap.
Red flags: any NFT you didn’t mint or buy, especially one carrying a URL or claim instructions. Most wallets and marketplaces let you hide or mark these as spam. Do that, and never visit the link.
How to Verify an NFT Project Before You Buy or Mint
A short verification routine stops most scams cold:
The platform itself can also be the problem, and our guide on how to detect dishonest NFT marketplaces lists nine red flags to check.
- Confirm the URL and contract address from the project’s official, established channels, not from a link someone sent you.
- Check the collection’s verification status on reputable marketplaces and compare the contract address character by character.
- Research the team: doxxed founders with a real history are safer than anonymous accounts making big promises.
- Slow down: countdowns and “limited spots” are designed to bypass your judgment. A real opportunity survives a five-minute pause to verify.
- Read every signature request before approving. If a prompt is unreadable or asks for broad permissions you didn’t expect, reject it.
How to Spot NFT Duplication Scams
To spot an NFT duplication scam, ignore the artwork and check the contract: a duplicate, or “copymint,” reuses a real collection’s images and name, but its contract address won’t match the one the project publishes. The real collection has one official contract per chain, and anything else is a copy, no matter how identical it looks. Duplication scams take a few common forms:
- Copymint collections: a full re-mint of a popular collection under the same or a near-identical name, listed on the same marketplace. Search results can show both, so sort by verification badge and volume, not by price.
- Cross-chain duplicates: the same artwork minted on a different blockchain, for example an Ethereum collection “re-released” on a cheaper chain, sold as an “official expansion.” Unless the project announces it on its own channels, it isn’t official.
- Duplicate single pieces: one-of-one artworks copied and listed by someone other than the artist. Check that the creator address matches the artist’s verified profile or the address on their official website.
- Lookalike names: collection names with an extra word, a swapped letter or a lookalike character, so a quick search lands on the fake.
The quick check: open the item’s details, copy the contract address, and compare it character by character with the address on the project’s official website or pinned announcement. Then confirm the collection’s volume and holder count make sense; a copy usually shows a handful of holders and almost no trading history. A listing priced far below the real floor is the biggest tell; our explainer on NFT floor prices shows how to check what the real floor is. Our guide to the best NFT marketplaces covers which platforms verify collections.
How to Detect NFT Scams Before You Sign
The most reliable way to detect an NFT scam is to read, or simulate, exactly what a transaction will do before you approve it. Your wallet can do much of that work for you:
- Turn on your wallet’s security alerts. MetaMask, Phantom and other major wallets simulate transactions and warn you when a request would transfer assets out, grant broad approvals or interact with a known malicious address. Don’t click through red warnings.
- Watch for gasless “listing” signatures. On marketplaces, a signature with no gas fee can still list your NFT for sale. Scam sites use this to get you to sign a listing at a price of zero, which the scammer then fills. If a site you’re “minting” or “claiming” on asks for an off-chain signature mentioning orders, offers or listings, reject it.
- Check the expected outcome. A real mint shows you paying the mint price and receiving an NFT. If the simulation shows NFTs or tokens leaving your wallet, or a setApprovalForAll request, stop.
- Use a hardware wallet that shows readable details. Devices with clear signing display what you’re approving on their own screen, which is harder for a compromised website to fake.
Protecting Your Wallet: Practical Defenses
Use a hardware wallet
A hardware wallet keeps your private keys offline, so even if you sign on a compromised computer, transactions must be physically confirmed on the device. For anyone holding meaningful value, this is the single biggest upgrade. See our overview of the best hardware wallets to choose one.
For valuable pieces, the strongest defense is moving them to a vault address; our guide to storing NFTs offline walks through the transfer step by step.
If unwanted tokens keep appearing in your wallet, our guide to burning and hiding spam NFTs explains how to remove them without signing anything risky.
Separate your wallets
Keep a “burner” or hot wallet for risky minting and a separate cold wallet for long-term holdings. If you connect a burner to a malicious mint, only the small amount in that wallet is exposed. Set up and manage these with MetaMask or a similar self-custody wallet.
Review and revoke token approvals
Periodically review which contracts have permission to access your tokens and NFTs, and revoke any you no longer use or don’t recognize. This neutralizes malicious approvals you may have granted in the past, before a scammer can act on them.
Never share your seed phrase
This is non-negotiable. Your seed phrase is the master key to everything. No mint, no support agent, no wallet app, and no “verification” process will ever legitimately ask for it. Anyone who does is a scammer, full stop.
What to Do If You Think You’ve Been Scammed
- Move remaining assets immediately to a fresh, secure wallet if you suspect the compromised wallet still has value.
- Revoke approvals for the malicious contract from the affected wallet.
- Stop using the compromised wallet if your seed phrase may be exposed; assume it is permanently unsafe.
- Report the scam to the marketplace and warn the community, but be realistic: on-chain transactions are generally irreversible.
Be wary of anyone who contacts you offering to get your NFTs back for an upfront fee; “recovery” offers are a common follow-up scam. Our guide to crypto scam recovery explains what is realistic. Recovery is rare, which is exactly why prevention matters so much. Treat every wallet connection and signature as a decision that could cost you everything in that wallet.
FAQ
Can someone steal my NFTs without my seed phrase?
Yes. Many NFT scams never touch your seed phrase. Instead, they trick you into signing a transaction that approves a malicious contract to move your assets, or into transferring them directly. Because you authorized it yourself, the theft is recorded on-chain as a normal action. This is why reading every signature request carefully is so important.
How do I know if an NFT collection is fake?
Compare the contract address against the project’s official source, check for marketplace verification badges, and be suspicious of listings priced far below the real floor. Counterfeit collections reuse the artwork and name but use a different contract, which makes them worthless. Never rely on artwork alone; the contract address is what proves authenticity.
Is it safe to click links from Discord or Twitter?
Treat all such links with caution. Hacked accounts and impersonators routinely post phishing and fake-mint links, even under legitimate-looking posts. Navigate to official sites directly through your own bookmarks instead of clicking shared links, and never connect your wallet or enter a seed phrase on a page you reached from a DM or comment.
What is the safest way to mint a new NFT?
Use a separate burner wallet funded with only what you need, connect through the project’s verified official URL, confirm the contract address independently, and read the signing prompt before approving. For valuable holdings, keep them in a hardware wallet that stays disconnected from risky minting activity entirely.
What should I do with a random NFT that appeared in my wallet?
Leave it alone and hide it. An unsolicited NFT can’t drain your wallet by itself, but its links and “claim” instructions usually lead to drainer sites. Don’t visit any URL in its name or description, and don’t try to sell it on an unfamiliar site. Most wallets and marketplaces let you mark it as spam so it stops appearing.
Crypto is volatile and risky; this is education, not financial advice. Do your own research.
