setApprovalForAll
setApprovalForAll is the ERC-721/ERC-1155 call that gives another address control of every NFT in a collection, and phishing sites request it to steal whole NFT holdings at once.
How it works
The call takes an operator address and a flag. With the flag set to true the operator may transfer any token of that collection from the owner's wallet, now and in the future, until the approval is revoked.
Fake mint and claim pages present it as a step of the mint; once confirmed, the attacker transfers the collection out.
Example from the PhishDestroy database
- io-search-q-opensea-btc-rvn-chrome-ob-utf-8.com: NFT-scam domain, first detected 2026-10-15.
- io-search-c-opensea-btc-rvn-chrome-ob-utf-8.com: NFT-scam domain, first detected 2026-10-15.
- io-search-f-opensea-btc-rvn-chrome-ob-utf-8.com: NFT-scam domain, first detected 2026-10-15.
How to protect yourself
- Never approve an operator you do not recognise; a real mint does not need control of your existing NFTs.
- Revoke old operator approvals for collections you hold.