NFTs have brought a revolution to digital art and collectibles, but they’ve also created a brand-new playground for fraudsters. Multi-million dollar rug pulls, fake collections, phishing attacks, and insider thefts — the NFT space has seen just as many spectacular collapses as it has shining stars. In this guide, I’ll walk you through the biggest NFT frauds in history, how they were executed, and most importantly, how you can protect yourself from falling into similar traps.
Warning: The incidents described in this guide are real fraud cases. The goal is to help you learn from these mistakes so you don’t become the next victim.
Why Are NFT Scams So Widespread?
The NFT ecosystem is still largely unregulated, highly anonymous, and moves enormous amounts of money. For scammers, it’s a dream environment. Here are the main reasons why fraud is so common:
- Lack of regulation: Most NFT projects are not monitored or reviewed by any official authority.
- Anonymity: Project founders can easily hide their real identities.
- FOMO (Fear Of Missing Out): The dream of getting rich quickly often stops investors from doing proper research.
- Low technical knowledge: Beginners often can’t tell the difference between phishing sites and legitimate smart contracts.
The Biggest NFT Scandals You Need to Know
Key lesson: Always be suspicious of projects run by anonymous teams. Are there real people behind those usernames? Do your homework.
Evolved Apes – A $2.7 Million Rug Pull
In October 2021, an NFT collection called “Evolved Apes” launched with 10,000 unique ape characters. The team promised to develop a fighting game using these NFTs. Excitement grew quickly, and the collection raised $2.7 million worth of Ethereum in no time.
But the founder — who used the alias “Evil Ape” — disappeared right after collecting all the funds. The official Twitter account and website were deleted. The community was left with nothing. Investors never got their game or their money back. Later, some community members formed a group called “Fight Back Apes” to try and take over the project, but only a tiny fraction of the lost money was ever recovered.
Baller Ape Club – $1.6 Million Insider Theft
Baller Ape Club became highly popular in early 2022. The founder was known simply as “Baller.” However, a developer on the team exploited a vulnerability in the smart contract, transferred some of the NFTs to himself, and sold them for about $1.6 million in Ethereum.
When the news broke, the project’s reputation was destroyed. The floor price of the NFTs collapsed to almost zero. Investors had been scammed by someone from inside the project team. This proved that rug pulls aren’t only an external threat — insiders can be just as dangerous.
Frosties – $1.1 Million Scam by Young Fraudsters
Frosties was an NFT collection featuring cute ice cream characters. Launched in January 2022, it sold out fast, generating $1.1 million in revenue. But right after the sale, the owners deleted all their social media accounts and vanished with the funds.
What made this case different from others? The scammers were actually caught. The U.S. Department of Justice arrested two 20-year-olds: Ethan Nguyen and Andre Llacuna. They were prosecuted on fraud charges. This was one of the first major arrests in NFT fraud history.
Lesson: The Frosties case proves that scammers don’t always get away with it. However, most are never caught. Prevention is still your best defense.
Big Daddy Ape Club (BDAC) – $1.3 Million Fake Collection
Big Daddy Ape Club looked like a variation of the famous Bored Ape Yacht Club. The team behind it claimed to have backing from well-known figures and made grand promises. After the collection sold out, the team disappeared.
What made this scam particularly interesting was that the fraudsters used bots to build a fake community months before the sale. Thousands of Twitter followers and tens of thousands of Discord members — but almost all of them were bots. That tricked many investors.
MekaVerse Bribery Scandal
MekaVerse was a hugely successful robot-themed NFT collection launched in 2021. But in 2022, allegations surfaced claiming the project team had taken bribes from a select group of investors in exchange for whitelist spots.
According to reports, certain large investors paid the team for early access to the rarest NFTs. This created an unfair playing field for regular investors. After the scandal broke, the MekaVerse community largely fell apart, and the value of the collection dropped significantly.
OpenSea Phishing Attack – $1.7 Million in Stolen NFTs
In February 2022, OpenSea — the largest NFT marketplace in the world — became the target of a major phishing attack. Scammers sent fake emails to OpenSea users claiming their NFTs needed to be “updated” and asking them to click a link.
Users who clicked the link were directed to a fake OpenSea website, where they were asked to sign a smart contract. By signing, they unknowingly gave the attackers control over their NFTs. A total of 254 NFTs from 17 users were stolen, with an estimated value of $1.7 million.
Lesson: Never click links from unsolicited emails or direct messages. Always type the official marketplace URL into your browser yourself. And never sign a smart contract you don’t fully understand.
The Possessed – $5 Million Failed Mint (Technical Scam)
The Possessed generated a massive amount of hype in 2022. On mint day, users flooded the site, triggering a “gas war” where everyone paid high gas fees just to mint faster.
But there was a flaw in the smart contract. Most of those high gas fees didn’t go to the project team — they went directly to miners. By the time the collection sold out, approximately $5 million worth of ETH had been burned on gas fees. The team only made a tiny amount, while investors overpaid and still didn’t get the NFTs they wanted.
Although this was technically a bug, many labeled it a scam because the team either didn’t notice or didn’t fix the issue beforehand.
BAYC Instagram Hack – $3.6 Million Phishing Attack
In April 2022, the official Instagram account of Bored Ape Yacht Club (BAYC) — one of the most valuable NFT collections in the world — was hacked. The attackers announced a “surprise airdrop” and directed followers to a fake website.
On that fake site, users were asked to connect their wallets and complete a “verification” step. In reality, they were signing away control of their NFTs. Around $3.6 million worth of Bored Apes and Mutant Apes were stolen. The incident showed that even verified accounts with millions of followers can be compromised.
Lesson: Be extremely cautious with any “free giveaway” or “surprise” announcement — even from official-looking accounts. Never trust a site that asks you to connect your wallet without triple-checking its authenticity.
Common Types of NFT Scams
Beyond the major headline-grabbing cases, here are the everyday scam techniques you’re likely to encounter:
Rug Pull: Project founders raise money from investors, make big promises (games, metaverse land, staking rewards), then disappear after the sale — deleting everything.
Fake Collections: Scammers copy popular collections with slightly different names (e.g., “Bored Ape Club” instead of “Bored Ape Yacht Club”) hoping buyers will mistake them for the original.
Phishing Attacks: Fake emails, DMs, or websites trick users into connecting their wallets. Once connected, the attacker can drain all assets.
Fake Whitelist Scams: Asking users to pay for whitelist spots. In legitimate projects, whitelists are usually free or earned through community participation.
Fake Offer Scams: A scammer sends a high offer for your NFT. When you accept, you’re actually selling it for a much lower price (the contract details are hidden).
Discord Hacks: Hackers break into Discord servers of popular NFT projects and post fake announcements with phishing links, saying things like “Mint is live — connect now.”
How to Protect Yourself from NFT Scams
Follow these golden rules to stay safe:
- Do your own research (DYOR): Investigate the team behind any project. Are they using real names? Do they have past projects or verifiable references? Anonymous teams are always risky.
- Use official channels only: Type the official project URL manually into your browser’s address bar. Don’t click ads on Google. Be skeptical of any links shared on Twitter, Discord, or Instagram.
- Never share your seed phrase: No support team, no platform, no “friend” should ever ask for your seed phrase. Anyone who asks is 100% a scammer.
- Review smart contracts before signing: Try to understand what you’re approving. Permissions like “Set Approval For All” can give another party full control over your wallet.
- Use a cold wallet: If you hold a large amount of NFTs or crypto, store them in a hardware wallet (Ledger, Trezor). Even if you accidentally connect to a phishing site, attackers can’t move funds without physical confirmation from your device.
- Be skeptical of “too good to be true”: Any project promising 100% profit guarantees, “risk-free gains,” or “free airdrops” is almost certainly a scam.
- Observe the community: Check whether the Discord or Twitter community is active with real conversations or just full of bots. Can you get answers to your questions? A healthy community is a positive sign.
What to Do If You Get Scammed
If you’ve fallen victim to an NFT scam, here are the steps you should take:
- Don’t panic: Stay calm and follow a clear sequence of actions.
- Don’t approve anything you’re unsure about: If something asks for a signature and you don’t trust it, decline immediately.
- Revoke suspicious permissions: Use platforms like Etherscan or Revoke.cash to cancel any “approve” permissions linked to your wallet.
- Create a new wallet: If you doubt your wallet’s security, move all remaining assets to a newly created wallet as soon as possible.
- Report to authorities: If you lost a significant amount, file a report with your local cybercrime unit — although recovery is rarely possible.
- Warn the community: Share your experience on Twitter or Discord to help others avoid the same trap.
The hard truth: Recovery rates for stolen NFT funds are extremely low. Because blockchain transactions are irreversible, most scammers are never caught and victims never get their money back. Prevention is your only real protection.
External resource (DoFollow): For real-time NFT scam alerts and security news, check Rekt News — a trusted source covering crypto and NFT fraud cases.
Internal link: Read our complete beginner’s guide on What Is NFT? A Complete Beginner’s Guide
Frequently Asked Questions
Unfortunately, in most cases no. Blockchain transactions cannot be reversed. Scammers are rarely caught, and recovered funds are even rarer. Your best defense is prevention.
Research the team’s real identities. Check if they have successful past projects. Look at the community — is it active and real or full of bots? Whitelists should be free or merit-based, not paid.
A rug pull is when project creators raise money from investors, make big promises, then disappear with the funds — usually deleting all social media and websites.
Never click links from unsolicited emails or DMs. Type the official website URL yourself. Never share your seed phrase. Never sign a smart contract you don’t trust.
A cold wallet (like Ledger or Trezor) greatly reduces risk. Even if you connect to a phishing site, attackers cannot move your assets without physically approving the transaction on your device.
Very rarely. The Frosties case was an exception. Most scammers get away due to anonymity and legal gaps between different countries.
