4 ms·

The NFT can also be a program that when you try to move the token or interact with it in any way, it can do things such as transferring funds to another wallet.

• pcthrowaway 4y ago
  There is no way this would work without approving the NFT contract to spend your tokens. Realistically, lots of people would do this because the complexity of blockchain tech is beyond most peoples' grasp, but there is a reasonable failsafe at least.
  • deleted 4y ago
    [deleted]
  • TremendousJudge 4y ago
    afaik it's already been done: https://bitcoinist.com/hackers-are-now-trying-to-steal-crypto-via-malicious-nfts/ https://bitcoinist.com/hackers-are-now-trying-to-steal-crypt...
    • pcthrowaway 4y ago
      > The source of the problem was not just the NFT and the airdrop. However, by releasing an NFT to a victim, they will see it. Then, there comes a follow-up message that demands a signature for connecting to a wallet. > Furthermore, a prompting request for a secondary signature will come up. If the user accepts it, the hackers will access the unsuspecting user’s wallet and funds. This is light on details, but as I said, the only way another address can spend a users tokens is if the victim address approves it (or if the token is not ERC20 conforming). This approval might be what the article refers to here as signatures. Alternately, this attack could somehow get a user to reveal their private key, in which case, of course an attacker has access to their funds.