How do fake NFT minting sites work, and what does a malicious mint signature do?

14 October 2026

Fake NFT minting sites trick you into signing a transaction that does something very different from minting a token. Instead of creating a new NFT in your wallet, the signature gives a scammer permission to transfer assets out of it. The site looks like a legitimate project’s mint page, but the contract call you approve is a transfer, an approval, or a permit signature - not a mint function.

How the scam is set up

A fake minting site is usually a cloned front-end. The attacker copies the HTML, CSS, and images from a real NFT project’s website, then hosts the copy on a lookalike domain. They may register the domain days or hours before the real mint goes live, and promote it through compromised Discord servers, Twitter accounts, or Google Ads.

When you connect your wallet, the site does not show a normal mint button. Instead, it asks you to sign a message or approve a transaction. The interface may say “Mint Now” or “Claim,” but the underlying contract interaction is different.

What a legitimate mint transaction looks like

A real NFT mint calls the mint function on the project’s smart contract. You pay gas and a mint price, and the contract creates a new token and assigns it to your address. No third party gets control of your existing tokens. The transaction only adds the NFT to your wallet.

What a malicious mint signature actually does

There are three common types of malicious signatures used on fake minting sites.

1. A token approval transaction

The site asks you to confirm a transaction that calls the approve or setApprovalForAll function on an ERC-20 or ERC-721 contract. This gives the scammer’s address permission to move tokens from your wallet. Once approved, the scammer can transfer your tokens without asking you again.

The transaction may appear to cost zero ETH and may not mention any token name you recognise. The recipient address in the transaction details is the scammer’s wallet, not the NFT project.

2. A permit signature (off-chain approval)

Some tokens support the ERC-2612 permit standard. This lets you sign a message off-chain that authorises a transfer. The fake site asks you to sign what looks like a harmless “mint signature.” In reality, the signed message includes the token contract, your address, the scammer’s address, and an amount.

The scammer takes that signature and submits it to the token contract as a valid approval. No second transaction is needed. Your tokens are gone as soon as the signature is on-chain.

This type of attack is covered in detail on the permit signature phishing page. The key point is that a permit signature does not show a transaction confirmation in your wallet. It looks like a simple message signing request.

3. A direct transfer transaction

In some cases, the fake site asks you to send a transaction that calls the transferFrom function. The site may show a “mint fee” of 0.001 ETH. The transaction sends that ETH plus your NFT to the scammer’s address in one call.

How to identify a fake minting site before you sign

The signs are the same as for any crypto phishing site, but with a few specific warnings.

• The domain is off. Check the URL character by character. Look for swapped letters (example.co vs example.com), extra words (nft-project-mint.com), or hyphens in unusual places. Use the site’s guide on checking a crypto URL for phishing.
• The site asks for a signature before showing you any content. Legitimate mint pages let you browse the collection, check the roadmap, and read the FAQ without connecting your wallet. If the first thing the site does is ask for a signature, leave.
• The mint button says “Approve” or “Sign” instead of “Mint.” A real mint button triggers a transaction that creates a token. An “Approve” button triggers an approval transaction. If the button text is vague, hover over it or inspect the page source.
• The contract address is not on the project’s official site. Compare the contract address shown on the mint page with the address on the project’s official website, their OpenSea collection page, or their Etherscan profile. If it does not match, it is a fake.
• The transaction preview shows a different function name. Most wallets show the function name when you confirm a transaction. If it says approve, setApprovalForAll, transferFrom, or permit, do not confirm.

What to do if you signed a malicious mint signature

If you approved a token, revoke the approval immediately. Use a token approval checker or Etherscan’s token approval tool. Find the scammer’s address and revoke permission for that token.

If you signed a permit signature, the approval is already on-chain. The scammer may not have executed the transfer yet. Move your remaining tokens to a new wallet as soon as possible. Do not wait.

If you already lost tokens, the transaction cannot be reversed. Report the scam to the platform where you found the link and to the blockchain explorer if possible. No recovery service can get your tokens back.

Why fake minting sites are common

NFT mints create urgency. A limited supply, a whitelist, and a countdown clock pressure users to act fast. Scammers exploit that urgency by launching fake sites just before or during the real mint. The window of opportunity is short, but effective: a user who rushes to mint may not check the URL or the transaction details.

Checking the URL, the contract address, and the transaction function takes thirty seconds. That is enough time to avoid losing your wallet.

Back to phishing