There are many reports of random NFTs being distributed to collectors' eth wallets on Opensea, and if the recipient accepts an offer to sell them, or lists them, they apparently verify a MetaMask signature that gives hackers access to drain the victim's wallet. All this occurs without phishing information whatsoever (ERC-721 NFTs, Polygon NFTs), but purely through malicious code in the NFT's smart contract. How is this even possible?

  • If this is happening can you post address of such a NFT ? Once deployed their code will be in the blockchain and can be inspected.
    – Sid Datta
    Sep 20, 2021 at 21:25
  • here is one such thread. please link where we can view the code of the contract in text, and let us know what you find in the contract's code that allowed it to empty the victim's wallet just by interacting with it. twitter.com/babbler_dabbler/status/1439987074594217986
    – user610620
    Sep 21, 2021 at 2:10

1 Answer 1


Looks like you have been following Twitter today. The user in question actually had their private keys compromised by a fake OpenSea email spam.

However attack vectors can be launched on smart contracts, so that when you interact with them or approve them they are given access to your wallet. Not sure exactly how it happens but it is through malicious code. Sorry I couldn't give a better answer.

  • thanks, hope a solidity dev can provide more details on the 2nd paragraph. How can a wallet be so insecure that it lets an interactor siphon all the money and NFTs away?
    – user610620
    Sep 21, 2021 at 2:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.