What are the main risks of buying or holding NFTs?

Scams

ethereum.org says NFT security problems most often come from phishing, bugs in smart contracts, or user mistakes, such as exposing private keys.²

In August 2023, the FBI warned of criminals posing as real NFT developers.¹ They take over a project's social media accounts, or make near-copies, to promote a fake new release.¹ Their posts push urgency, with words like "limited supply" or a "surprise" mint.¹ The links lead to a copy of the project's website. There, victims connect their wallets to a "drainer" contract, which sends their crypto and NFTs to the criminals.¹

ethereum.org also warns of airdrop scams. A scam token or NFT is sent to your wallet, with a link to a scam website to "claim" it.⁵

ERC-721 lets an owner approve an "operator" to manage all of their NFTs at once.³ So read what any transaction does before you sign it.⁵

Tips from the FBI and ethereum.org:^1,5

• Be wary of a surprise mint. Check whether the project has ever done one before.¹
• Check that the account is the project's real account, not a clone.¹
• Look for a misspelled web address, extra characters, or links that don't work.¹
• Check you are on the right website, especially after clicking a link.⁵
• Remember that a transaction on Ethereum can't be reversed.⁵

Fakes, copies and stolen NFTs

Any contract can copy another contract's name and symbol.³ Nothing in the technology stops someone minting an NFT of artwork they don't own.⁴ The US Patent and Trademark Office and Copyright Office found trademark infringement is common on NFT marketplaces.⁴

Several commenters told the US offices that blockchains can't tell "ownership" from "possession".⁴ If an NFT is taken in a phishing scam, they said, the blockchain can record the thief as the new holder.⁴

US prosecutors describe a "rug pull" as a project whose creator collects money from buyers, then suddenly abandons the project and keeps the money.⁶

Links, rights and royalties

• The picture can change or vanish. The metadata link can change, and a file on one server can be removed.^3,4
• You may not own the art. An NFT and the copyright in its work are separate.⁴
• Royalties may not be paid. Marketplaces pay them voluntarily.⁷

The law is still moving

The OpenSea case. On 1 June 2022, US prosecutors announced charges against Nathaniel Chastain, a former OpenSea manager, for wire fraud and money laundering.⁸ They alleged he secretly bought NFTs just before OpenSea featured them on its homepage. The charges were accusations, not proof.⁸

A jury convicted him in May 2023, and he was sentenced to three months in prison.^9,10 On 31 July 2025, an appeals court threw out the conviction.¹⁰ It said confidential business information must have commercial value to a company to count as its property under the wire fraud law.¹⁰ The trial judge had told the jury it could convict even without that.¹⁰

Prosecutors chose not to retry him. Under a January 2026 agreement, he gave up 15.98 ETH.^11,9 In February 2026, the case was formally dropped.⁹ As checked on 22 October 2026, no conviction stands.^10,9

The SEC's view. In August 2023, the SEC found that NFTs sold by a media company, Impact Theory, were investment contracts, and so securities.¹² The SEC found it had told buyers they would profit if it succeeded. It settled without admitting or denying the findings.¹²

In March 2026, the SEC issued an interpretation. It said digital collectibles, such as tokens for artwork or trading cards, are not themselves securities.¹³ But any such asset can still be sold as part of an investment contract, which is a security.¹³ Selling fractions of a single collectible could also count as selling a security, it said.¹³

Before the quiz