All about NFTs – FBI
The FBI Las Vegas Field Office wants to ensure that community standards for buying, selling and trading NFTs are followed by interested parties. By following common sense standards, you can help the NFT community thrive and keep participants free from life-changing financial loss or worse.
NFT theft
Even in lower traditional and crypto markets, NFT theft has increasingly become a community targeted by criminals of all stripes. Some NFT collections have become valuable and the darling of high-tech theft. NFT collections such as Bored Ape Yacht Club, Mutant Ape Yacht Club, Cyber Punks, Azuki and Cool Cats have elevated floor values and contain individual NFTs that are very valuable. It should come as no surprise that these are targeted by thieves.
How they do it
Usually it’s social engineering combined with some technical knowledge. Criminal adversaries will find NFTs they are interested in on social media or on exchanges and target them. Social media platforms are popular for chatting about buying, selling and trading NFTs, among many other NFT topics. Owners of valuable NFTs may be enticed to use a social media site instead of the exchanges to complete a transaction by attempting to avoid commissions, higher prices and/or unbalanced trades (to the benefit of the legitimate owner). Once a trade agreement is reached between the rightful owner and the criminal, the criminal sets up the trade and returns with a link in a direct message. By clicking on the link, the legitimate owner will see exactly what they expect to see. However, what the legitimate owner is really seeing is a fake website (phishing) that is made to look exactly like a legitimate website. Everything looks good to the legitimate owner and he/she connects his/her digital wallet to the website and executes the trade. By doing this, the legitimate owner has given full access to his/her digital wallet and will quickly notice that all his/her NFTs have been stolen. The stolen NFTs are listed on an exchange at a discounted price and sold quickly. The funds from the resulting sale are run through multiple wallets and/or mixers to “launder” it. Viola, a new victim is born.
How to defend against it
Since NFT theft can occur as a “drive-by” theft or over a period of time using social engineering tactics, it’s important to adhere to community standards to protect yourself.
- Do your due diligence. Check several NFT exchange sites to see if the NFT(s) you are interested in have been flagged for suspicious activity.
- Check social media for chatter related to the NFT(s) you are interested in.
- Be suspicious of heavily discounted NFTs. For example, if you know the floor price of a pool is 100 ETH, be suspicious if you can buy into the pool for 50 ETH.
- Don’t be afraid to contact current or previous owners. There are a myriad of ways to contact owners – even anonymously – either via the blockchain explorer or the applications you use.
- Transactions are permanently written to a public blockchain. To add an extra layer of protection, you can view anyone’s wallet activity on a blockchain explorer like Etherscan. You can also view a specific NFT’s activity on NFT exchange websites and/or the blockchain. Blockchain researchers can provide a wealth of useful information.
- Store NFTs and other digital assets in a hard wallet as opposed to software wallets or on an exchange. As the old saying in crypto goes “not your keys, not your cryptos”. The same can be applied to NFTs.
- If you are going to execute a trade, initiate it from a trusted trading website or exchange and not from a social media DM that contains a link. If you see one of these, chances are you’re phished.
Adhering to these community standards will keep the NFT markets fun and more importantly, safe.
What to do if you become a victim - The first thing you need to do is report it. You can report it to your local FBI field office or report it to IC3.gov. Have as many details as possible ready for the complaint and when an FBI agent contacts you.
Important reminder
If you knowingly buy, sell or exchange an NFT that you know or suspect has been stolen, you may be committing a crime.
