Solana NFT Minting Scam Hiuraii

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

MintSolanaNFT Website

Reddit user Hiuraii reports that they fell for an offer of a free NFT from the MintSolanaNFT website. After granting full permissions to the website (which was unaffiliated with Solana), their wallet was drained. They posted on Reddit to share their story for others. There is no evidence that any funds have been recovered.

This is a global/international case not involving a specific country.

About Hiuraii

Hiuraii is a Reddit user.

About MintSolanaNFT

MintSolanaNFT was a website which claimed that you could mint free NFTs.

"was some kind of christmas scam nft in my wallet, I didnt know what it was and pressed on it and it led me to their webseite mintsolananft dot com, I had to connect my wallet"

The Reality

"and auto transaction thing was on I guess? I didnt approve a transaction for my solana to send to any other address it said to pay for gas fees nothing else, after that all was gone."

"That scam website is asking users to turn on auto-approve in the settings, probably some ppl get scammed like that without signing anything."

What Happened

Hiuraii came across the mintsolananft website and completed the process, which did not mint him a free NFT and instead sent all of his funds to the website creator.

Key Event Timeline - Solana NFT Minting Scam Hiuraii

Date	Event	Description
January 3rd, 2022 5:09:39 AM MST	Reddit Post	Hiuraii posts about the incident on Reddit to issue a warning to others. They report being scammed of 16 Solana and emphasize the importance of caution while interacting with websites and wallets. They used the Phantom wallet and had their Solana stored there. They received a Christmas NFT promising a mint and followed the link to a scam website. Connecting their wallet to it led to the loss of their Solana. Feeling regretful, they stress the need to be careful, not trusting anyone or anything, and keeping information secure. The author expressed feeling foolish and advises others to take care and stay safe.
January 3rd, 2022 10:12:39 AM MST	Reddit Comment
January 3rd, 2022 11:46:52 AM MST	Refusing Free Solana	Hiuraii refuses the offer of 0.5 Solana to help him get back on his feet stating that he's "fine".

Technical Details

The scheme revolved largely around user ignorance of the different setting in their wallet. Users were prompted to enable an auto-approve feature, which would modify their wallet to do whatever a website requested without seeking confirmation from the user. This is incredibly dangerous to enable on an untrusted website.

The website was reportedly requesting users to turn on auto-approve in their settings.

Total Amount Lost

The amount lost was reportedly 16 Solana. The closing market price of Solana was .

The total amount lost has been estimated at $3,000 USD.

Immediate Reactions

The incident was shared with the community on Reddit.

Reddit Post Sharing Incident

Hiuraii posted on Reddit to share what happened.

hey guys,

so I was scammed for 16 solana yesterday and I want to warn you guys. Be careful with what you do and how you interact with websites and your wallet. I use the phantom wallet and I had all my solana in that wallet, I noticed a NFT in my collectibles which promised me a christmas NFT mint. This NFT led me to a scam website and I was dumb enough to connect my wallet to it and all my solana was scammed. I feel very stupid. I am just 20 years old and I don't even do much to earn money and I lost my investings now... it can all go down so quickly guys, just take care and never trust anyone or anything, keep everything to yourself and stay safe. I feel sh*t.

Take care and do better

edit: was some kind of christmas scam nft in my wallet, I didnt know what it was and pressed on it and it led me to their webseite mintsolananft dot com, I had to connect my wallet and auto transaction thing was on I guess? I didnt approve a transaction for my solana to send to any other address it said to pay for gas fees nothing else, after that all was gone

"[S]o I was scammed for 16 solana yesterday and I want to warn you guys. Be careful with what you do and how you interact with websites and your wallet. I use the phantom wallet and I had all my solana in that wallet, I noticed a NFT in my collectibles which promised me a christmas NFT mint. This NFT led me to a scam website and I was dumb enough to connect my wallet to it and all my solana was scammed. I feel very stupid. I am just 20 years old and I don't even do much to earn money and I lost my investings now... it can all go down so quickly guys, just take care and never trust anyone or anything, keep everything to yourself and stay safe."

"Take care and do better"

Reactions On Reddit

Multiple reactions were received on Reddit.

You will Make it back . Don’t give up there are many opportunities out there for you . [I don't like] scammers and anyone defending/envy them .

That scam website is asking users to turn on auto-approve in the settings, probably some ppl get scammed like that without signing anything.

Some users were skeptical of the loss.

This was almost believable until he said " I'm only 20 years old." Sounds like he's trying to play the pity card in hopes of getting gifted free sol from someone.

Ultimate Outcome

Users offered to assist the victim and praised the value of the experience.

Skeptical User Offers Solana

The formerly skeptical user offered some Solana to assist the victim, however this offer was rejected.

"Well when you put it like that, send me your address and ill send .5 SOL to do my part."

Valuable Life Lessons

The community commented on the value of the lessons delivered from this experience.

"That's not a bad price, actually. Now, for the rest of your life, not even your parents will have to worry that you might be taken advantage of. 16 SOLs in exchange for a lifetime devoid of naiveté... I'd be okay with that if I were you... (and I was you). The real cost of something like this happening, is when some people let it affect change their world, instead of just themselves. It takes most people til their 40s to feel that. Accept it, admit to it, and move on, confident in your new ability to take caution and be able to spot the other bullshitters that will come down the road. It's kinda like getting pushed in the face the first time... its embarrassing, sure... but the world is a little less scary after, and realize your still standing."

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

Ongoing Developments

TBD

Individual Prevention Policies

Additional diligence is needed whenever receiving communication. It is a very common tactic to claim to be the founder of a protocol such as Anatoly Yakovenko, and this requires a high degree of scrutiny to validate. The minting website makes contradictory claims about only 1,500 tokens being minted, while at the same time the NFT is also being sent to 300,000 Solana holders, which should raise questions. The website specifically requests to enable an auto-approve feature, claiming that the NFT won't be sent otherwise, which doesn't make sense as auto-approve is a convenience feature. The email address offered is support@solana.com, an official Solana email address, which again requires a great deal of scrutiny to validate.

Any time that you are promised any profit or benefit in exchange for an initial payment, smart contract approval, or deposit, pay special care as to whether the entity making that offer is trustworthy, actually who they say they are, and has the means to fulfill what they're promising. There are no magic algorithms providing guaranteed returns from trading or mining. Trading on average will lose money. Mining is expensive and complex. No one is going to immediately send back more than you sent them. NFT projects will rarely announce a surprise mint in only a single location. Are you fully prepared for the event your money is kept and nothing is delivered in return?

Avoid the use of smart contracts unless necessary. Minimize the level of exposure by removing or withdrawing assets whenever possible. Aim to choose smart contracts which have obtained third party security audits, preferably having been audited by at least three separate reputable firms. Pay attention to the audit reports, which smart contracts are covered, and whether the smart contract has been upgraded or modified since the report. Ensure that any administrative functions with the ability to remove funds from the smart contract are under the authority of a multi-signature wallet which is controlled by at least three separate and reputable entities.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Platforms such as wallets or exchanges should provide additional education for users so that they are aware of situations like this. An industry insurance fund could be established to assist affected users.

Never take for granted the limited knowledge of users of your service and their tendency to skip past provided information. It is recommended to design a simple tutorial and quiz for new users which explains the basics of seed phrases, strong password generation, secure two-factor authentication, common fraud schemes, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space. This tutorial and quiz should ensure their understanding and be a standard part of the sign-up or download process which is difficult or impossible to skip.

Work with other industry platforms to set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

The primary defense is better education for new users joining the space on common scams. Known and trusted platforms and entities can be reviewed and made available, along with official website addresses. In the event that users fall for a scam, it's important to have an organization to assist them with recovery and justice.

Create a standard tutorial and quiz for all new cryptocurrency participants, which is required to be completed once per participant. This tutorial and quiz should cover the basics of proper seed phrase protection, strong password generation, secure two-factor authentication, common fraud schemes, how to detect and guard against phishing attacks, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space.

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.