3 ms·

afaik it's already been done: https://bitcoinist.com/hackers-are-now-trying-to-steal-crypto-via-malicious-nfts/ https://bitcoinist.com/hackers-are-now-trying-to

• pcthrowaway 4y ago
  > The source of the problem was not just the NFT and the airdrop. However, by releasing an NFT to a victim, they will see it. Then, there comes a follow-up message that demands a signature for connecting to a wallet. > Furthermore, a prompting request for a secondary signature will come up. If the user accepts it, the hackers will access the unsuspecting user’s wallet and funds. This is light on details, but as I said, the only way another address can spend a users tokens is if the victim address approves it (or if the token is not ERC20 conforming). This approval might be what the article refers to here as signatures. Alternately, this attack could somehow get a user to reveal their private key, in which case, of course an attacker has access to their funds.