Solana NFT Minting Scam Hiuraii

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

MintSolanaNFT Website

Reddit user Hiuraii reports that they fell for an offer of a free NFT from the MintSolanaNFT website. After granting full permissions to the website (which was unaffiliated with Solana), their wallet was drained. They posted on Reddit to share their story for others. There is no evidence that any funds have been recovered.

This is a global/international case not involving a specific country.

About Hiuraii

Hiuraii is a Reddit user.

About MintSolanaNFT

MintSolanaNFT was a website which claimed that you could mint free NFTs.

"was some kind of christmas scam nft in my wallet, I didnt know what it was and pressed on it and it led me to their webseite mintsolananft dot com, I had to connect my wallet"

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

"and auto transaction thing was on I guess? I didnt approve a transaction for my solana to send to any other address it said to pay for gas fees nothing else, after that all was gone."

"That scam website is asking users to turn on auto-approve in the settings, probably some ppl get scammed like that without signing anything."

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Solana NFT Minting Scam Hiuraii

Date	Event	Description
January 3rd, 2022 5:09:39 AM MST	Reddit Post	Hiuraii posts about the incident on Reddit to issue a warning to others. They report being scammed of 16 Solana and emphasize the importance of caution while interacting with websites and wallets. They used the Phantom wallet and had their Solana stored there. They received a Christmas NFT promising a mint and followed the link to a scam website. Connecting their wallet to it led to the loss of their Solana. Feeling regretful, they stress the need to be careful, not trusting anyone or anything, and keeping information secure. The author expressed feeling foolish and advises others to take care and stay safe.
January 3rd, 2022 10:12:39 AM MST	Reddit Comment

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

The website was reportedly requesting users to turn on auto-approve in their settings.

Total Amount Lost

The total amount lost has been estimated at $3,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Reddit Post Sharing Incident

Hiuraii posted on Reddit to share what happened.

hey guys,

so I was scammed for 16 solana yesterday and I want to warn you guys. Be careful with what you do and how you interact with websites and your wallet. I use the phantom wallet and I had all my solana in that wallet, I noticed a NFT in my collectibles which promised me a christmas NFT mint. This NFT led me to a scam website and I was dumb enough to connect my wallet to it and all my solana was scammed. I feel very stupid. I am just 20 years old and I don't even do much to earn money and I lost my investings now... it can all go down so quickly guys, just take care and never trust anyone or anything, keep everything to yourself and stay safe. I feel sh*t.

Take care and do better

edit: was some kind of christmas scam nft in my wallet, I didnt know what it was and pressed on it and it led me to their webseite mintsolananft dot com, I had to connect my wallet and auto transaction thing was on I guess? I didnt approve a transaction for my solana to send to any other address it said to pay for gas fees nothing else, after that all was gone

"[S]o I was scammed for 16 solana yesterday and I want to warn you guys. Be careful with what you do and how you interact with websites and your wallet. I use the phantom wallet and I had all my solana in that wallet, I noticed a NFT in my collectibles which promised me a christmas NFT mint. This NFT led me to a scam website and I was dumb enough to connect my wallet to it and all my solana was scammed. I feel very stupid. I am just 20 years old and I don't even do much to earn money and I lost my investings now... it can all go down so quickly guys, just take care and never trust anyone or anything, keep everything to yourself and stay safe."

"Take care and do better"

Reactions On Reddit

Multiple reactions were received on Reddit.

You will Make it back . Don’t give up there are many opportunities out there for you . [I don't like] scammers and anyone defending/envy them .

That scam website is asking users to turn on auto-approve in the settings, probably some ppl get scammed like that without signing anything.

Some users were skeptical of the loss.

This was almost believable until he said " I'm only 20 years old." Sounds like he's trying to play the pity card in hopes of getting gifted free sol from someone.

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Skeptical User Offers Solana

"Well when you put it like that, send me your address and ill send .5 SOL to do my part."

"That's not a bad price, actually. Now, for the rest of your life, not even your parents will have to worry that you might be taken advantage of. 16 SOLs in exchange for a lifetime devoid of naiveté... I'd be okay with that if I were you... (and I was you). The real cost of something like this happening, is when some people let it affect change their world, instead of just themselves. It takes most people til their 40s to feel that. Accept it, admit to it, and move on, confident in your new ability to take caution and be able to spot the other bullshitters that will come down the road. It's kinda like getting pushed in the face the first time... its embarrassing, sure... but the world is a little less scary after you you get fucked bad, and realize your still standing."

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

Any time that you are promised any profit or benefit in exchange for an initial payment, smart contract approval, or deposit, pay special care as to whether the entity making that offer is trustworthy, actually who they say they are, and has the means to fulfill what they're promising. There are no magic algorithms providing guaranteed returns from trading or mining. Trading on average will lose money. Mining is expensive and complex. No one is going to immediately send back more than you sent them. NFT projects will rarely announce a surprise mint in only a single location. Are you fully prepared for the event your money is kept and nothing is delivered in return?

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

Work with other industry platforms to set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

The primary defense against these types of frauds is better education for new users joining the space. By educating users on common scams, they can be on the look out. Known and trusted platforms and entities can be reviewed and made available. In the event that users fall for a scam, it's important to have an organization to assist them with a recovery and tracking funds.

Create a standard tutorial and quiz for all new cryptocurrency participants, which is required to be completed once per participant. This tutorial and quiz should cover the basics of proper seed phrase protection, strong password generation, secure two-factor authentication, common fraud schemes, how to detect and guard against phishing attacks, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space.

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.