CenturionDEX Support
Crypto basicsSecurityNetworksFAQsLaunch app

Malicious NFT contract scams#

Last modified: August 10, 2026

Malicious NFT contract scams use fake or compromised minting pages to make you sign a wallet request that transfers assets, grants an operator approval, or exposes a wallet secret. On Centurion, NFTs may use CRC-721 or CRC-1155 standards.

What it looks like#

A fake project account announces a limited NFT mint. You connect your wallet and expect to pay a small CTN mint cost. Instead, the wallet request asks to approve an operator for all NFTs in a collection. After approval, the attacker transfers your NFTs without another prompt.

How the scam works#

Attackers may:

  • Impersonate an upcoming project right as the real project launches.
  • Copy artwork, names, profiles, and community posts.
  • Use a fake mint button to request broad NFT operator approval.
  • Hide a token approval or transfer in a batch transaction.
  • Ask for an unlimited amount when only a small mint cost was expected.
  • Claim a failed mint requires a separate “sync,” “unlock,” or “refund” signature.

A wallet transaction can be legitimate when minting an NFT, but the details must match what you intended to do. A request for broad operator approval is higher risk than a one-time payment.

Checks before minting#

  1. Reach the project site from an official source you verified independently.
  2. Confirm the contract address and network before connecting.
  3. Read whether the wallet request is a payment, mint, approval, or operator permission.
  4. Avoid minting from links in direct messages, ads, or unexpected airdrops.
  5. Revoke permissions you no longer need. Revoking permissions incurs a Centurion network cost measured in Newtons and paid in CTN.

If you already approved a malicious contract#

Stop using the site. Review CRC-20 allowances, CRC-721 and CRC-1155 operator approvals, and smart-account permissions. Revoke suspicious permissions through a trusted Centurion-compatible tool or follow How to revoke a token approval. If a recovery phrase or private key was exposed, move remaining assets to a new wallet created on a clean device.

Related#