TLDR
Phishing site ('free mint', 'NFT migration to V2') prompts wallet to sign setApprovalForAll(operator=ATTACKER, approved=true) on a BAYC/Azuki/Pudgy contract. Attacker then transferFroms all NFTs. Indicators: (1) wallet prompt shows 'Set...
How it works
Phishing site ('free mint', 'NFT migration to V2') prompts wallet to sign setApprovalForAll(operator=ATTACKER, approved=true) on a BAYC/Azuki/Pudgy contract. Attacker then transferFroms all NFTs. Indicators: (1) wallet prompt shows 'Set...
Red flags
- Urgent pressure to click, pay, or share codes immediately.
- A link or sender that does not match the official organization.
- Requests for card data, passwords, OTPs, wallet signatures, or bank transfers.
What to do
- 1WHAT TO DO: NEVER sign setApprovalForAll for unknown operators; use Delegate.cash to interact safely.
Source
FAQ
Is setApprovalForAll NFT drain — fake mint or migration a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
Urgent pressure to click, pay, or share codes immediately.; A link or sender that does not match the official organization.; Requests for card data, passwords, OTPs, wallet signatures, or bank transfers.
What should I do first?
WHAT TO DO: NEVER sign setApprovalForAll for unknown operators; use Delegate.cash to interact safely.
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.