It wasn't just giving something. The NFT was given, but this in itself does nothing. The victim was then asked to stake that NFT. To stake an NFT, the smart con

It wasn't just giving something. The NFT was given, but this in itself does nothing. The victim was then asked to stake that NFT. To stake an NFT, the smart contract that does the staking needs access to your wallet. This too is normal. Except that the permission prompt asked for approval on another smart contract by means of a misleading name. There's nothing broken here. A smart contract is just a piece of code that moves money. You better be sure about what it's doing before you allow it to run. There's blue chip smart contracts that are proven and thoroughly audited, but anything else you need to read the code. Same as reading a contract before you sign it.