Cisco Talos researcher, Jaeson Schultz has uncovered several tricks cybercriminals could use to defraud users buying or minting NFTs. This includes malicious smart contracts, sleepminting, and seed phrases.
The seed phrase is a representation of a long string of random numbers. A digital wallet uses it to generate the private keys that let users send and spend their crypto.
Bad actors, therefore, disguise themselves as customers service agent while offering to help users as long as they provide the seed phrase for their wallet.
Sleepminting involves attackers using malicious smart contracts to mint NFTs to other people’s wallets. The minted NFTs are then transferred from those other wallets so the NFT can be sold to an unsuspecting buyer.
Steps NFT buyers can take to protect themselves include using good security fundamentals (solid passwords, MFA), and examining internet, ENS domain, and crypto wallet addresses.
Others include using a hardware wallet to add another layer of security, rejecting every request to disclose their seed phrases, researching their purchases, and verifying the source code of a smart contract before buying anything.