What Is an NFT (Non-Fungible Token)?

TL;DR — What You Need to Know About NFTs in 2026

An NFT (Non-Fungible Token) is a unique token on a blockchain, most commonly built on the ERC-721 or ERC-1155 standards on Ethereum, or Metaplex Token Metadata on Solana. Unlike fungible cryptocurrencies such as Bitcoin or Ether — where 1 ETH always equals 1 ETH — every NFT carries its own tokenId and metadata, making it non-interchangeable with another instance. Quick snapshot:

• What it is: a digital ownership certificate written into a smart contract — not the JPG itself, but a record of “who controls token X inside contract Y”, paired with metadata that usually lives on IPFS or Arweave.
• How it works: the owner is whoever controls the wallet’s private key (MetaMask, Phantom, Ledger, Trezor); transfers, mints and sales are executed by smart contracts, with every action paying gas.
• Is it safe: the technology is neutral, but the 2024-2026 ecosystem is full of rug pulls, wallet drainers (Inferno, Pink, Angel), lookalike-domain phishing, sleepminting and wash trading. Drainers alone stole more than $494M from about 332,000 victims in 2024 (Scam Sniffer). NFT security is wallet hygiene first, technology second.

NFT vs FT vs SBT — A Quick Comparison

Property	NFT (Non-Fungible Token)	FT (Fungible Token)	SBT (Soulbound Token)
Fungibility	Non-fungible (1 ≠ 1)	Fungible 1:1	Non-fungible and non-transferable
Standard	ERC-721, ERC-1155, Metaplex	ERC-20 (Ethereum), SPL (Solana)	ERC-5114, EIP-4973 (draft)
Primary use case	Digital art, gaming, ticketing, RWA	Cryptocurrencies, stablecoins, governance	Identity, diplomas, memberships, reputation
Tradeable	Yes (OpenSea, Blur, Magic Eden)	Yes (Uniswap, Binance, Coinbase)	No — bound to the wallet by design
Example	CryptoPunks, BAYC, Pudgy Penguins	USDC, USDT, DAI, UNI	POAP, Gitcoin Passport, ENS stamps

In practice the three categories represent three different ownership models: NFTs are “unique assets with a secondary market”, FTs are “interchangeable units of value or rights” and SBTs are “non-transferable proofs of something about you” (a completed course, DAO membership, KYC attestation). Each has a different risk profile — NFTs and FTs can be stolen by drainers, while SBTs are by definition non-transferable (so they cannot be classically stolen — though the key controlling the identity remains an attack vector).

NFT Standards and Architecture

ERC-721 — the first NFT standard

ERC-721 (Ethereum Request for Comments 721, finalized in 2018) is the foundational NFT standard on Ethereum. Every token has a unique tokenId, and the interface defines ownerOf(tokenId), transferFrom(from, to, tokenId), approve(operator, tokenId) and safeTransferFrom. Classic collections — CryptoKitties, CryptoPunks v2, Bored Ape Yacht Club, Pudgy Penguins, Doodles, Azuki — are all ERC-721.

ERC-1155 — the multi-token standard

ERC-1155 (proposed by Enjin in 2019) allows a single contract to issue both NFTs and fungible tokens — for example, one unique sword (ERC-721 style, supply of 1) and a thousand identical healing potions (ERC-20 style, batchable). The standard is used by The Sandbox, Adidas Originals, OpenSea’s Shared Storefront and most modern gaming projects. Key advantages: batch transfers (one transaction instead of dozens), lower gas costs and easier handling of semi-fungible collections.

Metaplex on Solana

On Solana the dominant standard is the Metaplex Token Metadata Program — not a single “ERC-721 for Solana”, but a program (smart contract) that defines metadata standards for SPL tokens with a supply of 1. Solana NFTs are cheap to trade (gas fees are fractions of a cent versus $5-50 on Ethereum), but the ecosystem (Magic Eden, Tensor) is smaller and has historically had its own security incidents — most notably the August 2022 Slope wallet incident, which leaked seed phrases of about 8,000 wallets and led to roughly $8M in losses.

Bitcoin Ordinals

A 2023-2024 addition to the landscape, Bitcoin Ordinals inscribe data directly into individual satoshis on the Bitcoin base layer, producing fully on-chain NFTs without smart contracts. Marketplaces such as Magic Eden Ordinals and Gamma facilitate trading. Ordinals expanded the attack surface to Bitcoin holders, who had previously been outside the NFT scam ecosystem.

Metadata — on-chain vs off-chain

This is the single most misunderstood aspect of NFTs. The token on the blockchain only stores an ID and a pointer (URI) to the metadata — not the image itself. The JPG, PNG, MP4 or GLB file usually lives on:

• IPFS (InterPlanetary File System) — distributed storage where the file address is a content-hash CID; if no node pins the file, it can disappear,
• Arweave — “permanent storage” paid up-front, designed for long-term availability,
• A project-controlled server — the worst option; if the team shuts down hosting, the NFT renders a broken image (a phenomenon known as “NFT rot”, documented across many older collections),
• Fully on-chain — the artwork encoded directly inside the contract (CryptoPunks v2, Bitcoin Ordinals, Autoglyphs); more expensive to mint, but effectively indestructible.

From a security standpoint: before buying an NFT, check where the metadata lives. Off-chain hosting on a project server is a single point of failure. On-chain or Arweave maximize durability.

How NFTs Work — From Mint to Transfer

Mint

Minting is the issuance of a new token. A creator deploys a smart contract (often based on the OpenZeppelin ERC-721 template), a user calls mint(), pays gas plus any mint price, and the contract records ownerOf(tokenId) = msg.sender. Under EIP-2981 (NFT Royalty Standard) the creator can define a percentage royalty on every subsequent secondary sale.

Transfer and ownership proof

Every transfer is a call to transferFrom(from, to, tokenId). Ownership is verified by matching msg.sender == ownerOf(tokenId) or by an outstanding approval. The full history is visible on Etherscan (Ethereum), Solscan (Solana) or Mempool.space (Bitcoin) — address, block, transaction hash. This is the core promise of blockchain provenance: an ownership history that cannot be silently rewritten.

Royalties — the 2023-2026 controversy

EIP-2981 defined the standard, but marketplaces decide whether to honour it. In 2023 Blur popularised “0% royalty” trading to drive volume and undercut OpenSea, which kicked off marketplace royalty wars. By 2026, OpenSea has restored enforced royalties (with optional opt-out), Magic Eden uses a similar model, and Blur retains low-royalty defaults. Security takeaway: don’t assume royalties reach the creator — many collections are routinely traded through “no-royalty” venues.

Primary NFT Use Cases in 2026

• Digital art — Beeple (“Everydays: The First 5000 Days”, $69.3M at Christie’s in March 2021), Pak (“Merge”, $91.8M in December 2021), Tyler Hobbs (Fidenza), Refik Anadol. After the 2022-2023 cooldown, the market has stabilised at roughly $1-2B in annual volume (versus the $25B peak of 2021).
• Gaming items — Axie Infinity, Gods Unchained, Illuvium, The Sandbox, Pixels. The March 2022 Ronin Bridge hack ($625M, attributed to the Lazarus Group / APT38) exposed systemic risk in cross-chain bridges underpinning gaming economies.
• Identity and credentials (SBTs, POAPs) — POAP (Proof of Attendance Protocol) for event participation, Gitcoin Passport for sybil resistance, Ethereum Name Service (name.eth as a Web3 identity primitive).
• Real-world assets (RWA) — tokenized real estate, wine, bonds and treasury bills. Pilots include BlackRock BUIDL, Ondo Finance, Centrifuge and Maple Finance.
• Ticketing — Ticketmaster has piloted NFT tickets since 2022 (Avenged Sevenfold, NBA games), and Coachella sold lifetime passes as the Coachella Keys Collection in 2022.
• Brand loyalty — Nike .SWOOSH (built on Polygon), Starbucks Odyssey (wound down in December 2024 — a cautionary tale about Web3 brand programs), Reddit Collectible Avatars (over 10M users at peak, also discontinued in 2024).

NFT Security — The Threat Landscape in 2026

This is the section this article exists for. nFlo is a cybersecurity firm, and Web3 is currently one of the hottest grounds for consumer attacks. The 2024-2026 NFT threat landscape:

Rug pulls

Founders mint a collection, market it on Discord and X, collect ETH or SOL from the mint, and then close the project and vanish. Canonical cases:

• Frosties (January 2022) — $1.1M; founders Ethan Nguyen and Andre Llacuna were arrested by the FBI and IRS in March 2022 and charged with wire fraud.
• Evolved Apes (October 2021) — $2.7M; the founder “Evil Ape” disappeared with the marketing budget.
• Big Daddy Ape Club (Solana, January 2022) — $1.3M.

Warning signs: an anonymous, undoxxed team, no smart-contract audit, aggressive FOMO marketing, generous “whitelist” perks, and contract ownership not renounced (meaning the founders can change logic after mint).

Wallet drainers — the dominant 2024-2026 vector

A wallet drainer is a malicious script attached to a fake claim, mint or airdrop page. After the wallet connects and the user signs a transaction (most often setApprovalForAll or an EIP-2612 permit), the drainer gains permission to move every supported token out of the wallet. The 2024 ecosystem:

• Inferno Drainer — the most infamous phishing kit, retired by its operators in November 2023 after stealing ~$80M from ~100,000 victims.
• Pink Drainer — the successor, ~$75M from over 21,000 victims in 2024.
• Angel Drainer, Pussy Drainer, Monkey Drainer — subsequent iterations.

Aggregate 2024 losses (Scam Sniffer): over $494M from roughly 332,000 victims — about 67% higher than 2023. Drainers are by far the largest single category of NFT-related loss today.

Sleepminting

An attack on provenance. A malicious creator exploits a flaw in a contract to mint an NFT “on behalf of” a well-known address (for example Beeple) — the transfer history then shows the NFT moving from Beeple → attacker, falsely implying that the artist personally sold the work. First demonstrated publicly in 2021 by Monsieur Personne with “Sleepminted Beeple”.

Copyminting

The simplest vector: stealing someone else’s art and listing it as your own on OpenSea or Magic Eden. OpenSea reported in 2022 that more than 80% of NFTs minted via its free creator tool were plagiarism, spam or fake. Marketplaces have rolled out perceptual-hash image detection and community reporting, but the arms race continues.

Wash trading

Artificially pumping prices by trading between the team’s own wallets or wallets controlled by related actors. The Chainalysis 2022 report identified hundreds of NFT collections with more than 25% of volume coming from wash trades. The goal is to fabricate liquidity and high prices and attract real buyers. TRM Labs and Chainalysis Reactor now specialise in detecting wash-trade patterns.

Smart-contract exploits

Technical flaws in the contract itself:

• Re-entrancy — the attacker calls a function that recursively re-enters itself before state is updated (the classic vector behind the 2016 DAO hack, and still appears in NFT mints),
• Integer overflow / underflow — manipulating fixed-width integers to bypass checks,
• Front-running / MEV — attackers observe pending transactions and insert their own ahead, sniping rare NFTs at listing time.

OpenZeppelin, Trail of Bits, ConsenSys Diligence and CertiK are the leading audit firms. No audit equals a red flag.

Lookalike-domain phishing

The simplest and most common vector. Attackers register domains such as opensea-claim.io, blur-airdrop.com, magiceden-rewards.xyz, opensea.ws, or 0pensea.io (a zero instead of an O), build a pixel-perfect clone and drive traffic via Twitter ads, Discord DMs or email. After the wallet connects, the drainer signature follows. Scam Sniffer, Wallet Guard and PhishFort publish daily takedown reports of these domains; in the EU, ENISA and the network of national CERTs warn of country-specific waves, and in the UK the NCSC runs a Suspicious Email Reporting Service.

Social engineering on Discord and Telegram

A fake “project moderator” sends a DM: “Hi, exclusive mint for early supporters, click here”. Legitimate Discord moderators never DM first about mints — this is the iron rule of every serious project. The scheme keeps working because victims want to believe the whitelist is real. Telegram variants impersonate “support” agents from MetaMask, Ledger or Phantom.

How to Protect Yourself From NFT Scams — Ten Rules

1. Use a hardware wallet (Ledger, Trezor, GridPlus Lattice1) for anything valuable. The private key never leaves the device, and signing happens offline. At $60-150, the ROI on a single avoided drainer is enormous.
2. Keep a separate “burner” hot wallet for minting — hold only the ETH or SOL needed for the operation; main assets stay in cold storage and never connect to dApps casually.
3. Never sign blind transactions. If MetaMask or Phantom shows raw hex instead of a readable action (“Approve OpenSea to transfer all your CryptoPunks”) — refuse. Ledger Live has a “Blind Signing” mode; enable it only when genuinely required for a specific contract.
4. Trust only verified-badge listings. OpenSea, Blur and Magic Eden mark official collections with a blue or purple tick. Don’t follow links from Discord, Telegram or X — open the marketplace by URL, search the collection there, and mint from inside the marketplace.
5. Audit revoke.cash every quarter. revoke.cash and etherscan.io/tokenapprovalchecker show all active approvals on your tokens. Revoke approvals for any contract you no longer use — this is the highest-priority hygiene step.
6. Bookmark the real domains. Type opensea.io, blur.io, magiceden.io manually or open from bookmarks. Never click marketplace links from Google ads (attackers buy ads on marketplace brand names), Discord DMs or Telegram messages.
7. Use hardware 2FA (YubiKey) for email (Gmail, ProtonMail), Discord, Twitter and marketplace accounts. SMS 2FA is breakable through SIM-swap attacks.
8. Never share your seed phrase. No legitimate support — MetaMask, OpenSea, Coinbase, Ledger — will ever ask for your 12- or 24-word recovery phrase. Any such request is a scam, full stop.
9. Read Etherscan or Solscan before minting. Check: unique holder count, contract deployment date (fresh = risk), whether ownership has been renounced, whether the contract is audited (links typically appear in the “Contract” tab).
10. Use transaction-simulation tools. Rabby Wallet, Wallet Guard, Pocket Universe and Fire Extension show, before you sign, exactly what the transaction will do to your wallet (“You will lose 5 ETH and 12 NFTs”). These are free tools, and not installing them in 2026 is a basic failure of hygiene.

What to Do If You’ve Been Scammed

Six steps, measured in hours rather than days:

1. Disconnect every dApp from the wallet. MetaMask: Settings → Connected sites → Disconnect all. Phantom and Rabby work the same way.
2. Revoke approvals immediately. Go to revoke.cash or etherscan.io/tokenapprovalchecker and revoke every unknown contract. This costs gas, but it is the only way to stop ongoing draining if the attacker holds an active approval.
3. Move remaining assets to a fresh wallet (new seed phrase, ideally on a hardware wallet). Treat the compromised wallet as permanently burned.
4. Report to the marketplace — OpenSea, Blur and Magic Eden all have report forms. Tagging a scam contract helps freeze listings and warns other users.
5. File reports with national authorities:
   • US: the FBI’s Internet Crime Complaint Center at IC3.gov, the FTC at ReportFraud.ftc.gov, and your state attorney general; for sanctioned addresses, OFAC’s reporting channel.
   • UK: Action Fraud (0300 123 2040, actionfraud.police.uk), the NCSC Suspicious Email Reporting Service (report@phishing.gov.uk), and the Financial Conduct Authority if a token was marketed as an investment.
   • EU: your national CERT/CSIRT (the European network is coordinated by ENISA), your national financial supervisor where applicable, and Europol for cross-border cases.
   • Canada: the Canadian Anti-Fraud Centre (antifraudcentre.ca).
   • Australia: Scamwatch (scamwatch.gov.au) and the Australian Cyber Security Centre.
6. Tag the attacker’s address publicly. Etherscan and Solscan accept community reports of scam addresses. Chain-analytics firms — Chainalysis Reactor, TRM Labs and Elliptic — ingest these tags to trace stolen funds for law enforcement.

Realistic expectations: if funds passed through mixers (Tornado Cash before its OFAC SDN designation in August 2022, then Railgun, eXch or Sinbad) the recovery rate is below 5%. Prevention is the only strategy that actually works at scale.

The 2026 Regulatory Landscape

• EU — MiCA (Markets in Crypto-Assets Regulation) — fully in force as of December 2024. Unique, non-fungible NFTs are explicitly excluded from most MiCA obligations (Article 2(3)), but fractional NFTs and quasi-fungible collections fall within scope and trigger the full crypto-asset service provider regime. ESMA and national regulators publish guidance on the boundary.
• US — SEC enforcement — the SEC has pursued multiple NFT cases under the Howey test, treating “fractional” or yield-bearing NFTs as unregistered securities. In August 2024 OpenSea received a Wells Notice signalling potential enforcement (later withdrawn in February 2025). Earlier actions against Impact Theory ($6.1M settlement, 2023) and Stoner Cats ($1M, 2023) established that promotional NFTs marketed as investment opportunities can be securities.
• US — tax — NFTs are classified as collectibles for federal tax purposes under IRS Notice 2023-27 (March 2023), which means a higher capital-gains rate of up to 28% (versus 20% for ordinary long-term capital assets). The earlier IRS Notice 2014-21 established that crypto is property; Notice 2023-34 updated treatment of digital-asset airdrops and forks.
• UK — HMRC — HMRC issued specific NFT guidance in 2023 within the Cryptoassets Manual (CRYPTO22250); NFTs are subject to Capital Gains Tax on disposal and may attract Income Tax for creators. The FCA treats NFTs marketed with investment characteristics as financial promotions in scope of its rules. The NCSC publishes consumer-level warnings on Web3 phishing.
• FATF Travel Rule — since 2024 Virtual Asset Service Providers (VASPs) must transmit originator and beneficiary information for transactions above $1,000. NFT marketplaces are formally in scope as jurisdictions implement; the Financial Action Task Force explicitly named NFT platforms in its 2023 update.
• OFAC sanctions — the US Office of Foreign Assets Control sanctions reach NFT transactions too. Tornado Cash was added to the SDN list in August 2022; addresses interacting with it are widely blocked on OpenSea, Blur and Magic Eden, and sanctions enforcement actions have already targeted NFT-related sanctions evasion.
• Chainalysis Crypto Crime Report 2024 documents over $5B in global crypto-scam losses, with drainers representing the largest year-on-year increase.

How nFlo Helps With Crypto and Web3 Security

Most consumer-grade NFT scams reduce to phishing and social engineering — exactly nFlo’s domain. We help companies and individual professionals:

• audit wallet hygiene and transaction-signing procedures,
• deploy hardware-key MFA (YubiKey) for email and marketplace accounts,
• run phishing-awareness training for Web3 teams, gaming studios and NFT projects,
• investigate incidents using Etherscan / Solscan tracking, Chainalysis Reactor and TRM Labs,
• respond to incidents that hit the supporting infrastructure (compromised email, social accounts used to operate corporate wallets).

Related glossary entries: phishing, social engineering, malware, security controls, scam.

FAQ

What is an NFT in simple terms?

An NFT (Non-Fungible Token) is a unique record of ownership on a blockchain. Unlike fungible cryptocurrencies, where 1 ETH always equals another 1 ETH, every NFT has its own tokenId and metadata and cannot be swapped 1:1 with another token. The most common standards are ERC-721 and ERC-1155 on Ethereum and Metaplex on Solana. An NFT can represent digital art, an in-game item, a concert ticket, a training certificate (Soulbound Token) or fractional ownership of a real-world asset (RWA). Crucially, an NFT is not the file itself — it is a record inside a smart contract, while the JPG usually sits on IPFS, Arweave or a centralized server.

Is NFT a scam?

NFT as a technology is not a scam — it is an ownership standard used legitimately by Nike (.SWOOSH), Starbucks Odyssey, Reddit Collectible Avatars, Ticketmaster and Adidas, and by major artists such as Beeple, Pak and Tyler Hobbs. The risk lives in specific projects and attack vectors: rug pulls (Frosties — $1.1M, Evolved Apes — $2.7M), wash trading, wallet drainers (Inferno, Pink), sleepminting and copyminting. NFT security is, above all, wallet hygiene rather than the technology itself.

What is a wallet drainer?

A malicious script that empties a wallet after a single malicious signature. Notable kits: Inferno Drainer (retired November 2023, ~$80M from 100,000 victims), Pink Drainer ($75M from 21,000+ victims), Angel and Pussy Drainer. Scam Sniffer reports $494M+ stolen from ~332,000 victims in 2024. Defence: never sign blind transactions, audit revoke.cash, use Wallet Guard / Pocket Universe / Rabby for transaction simulation.

How do I verify that an NFT project is legitimate?

Ten-point checklist: doxxed team, public smart-contract audit (OpenZeppelin, Trail of Bits, ConsenSys Diligence, CertiK), Etherscan/Solscan inspection (deployment date, holder count, renounced ownership, verified source), marketplace verified badge, sane mint mechanics, EIP-2981 royalty configuration, healthy holder distribution, no wash-trade signals (NFTGo, Chainalysis Reactor), durable metadata location (IPFS pinned by multiple providers or Arweave), real community discussion rather than shill bots. Three failed checks — walk away.

What should I do if I’ve been scammed in an NFT or wallet-drainer attack?

Six steps: (1) disconnect every dApp, (2) revoke approvals at revoke.cash, (3) move remaining assets to a fresh hardware wallet, (4) report to the marketplace (OpenSea, Blur, Magic Eden), (5) file with national authorities — IC3.gov + FTC + state AG (US), Action Fraud + NCSC (UK), national CERT + ENISA + Europol (EU), Canadian Anti-Fraud Centre (CA), Scamwatch (AU) — and (6) tag the attacker’s address publicly on Etherscan / Solscan so Chainalysis, TRM Labs and Elliptic can trace the funds. Realistic recovery rate if funds pass through mixers: below 5%. Prevention is the only strategy that scales.