incident 2026-09-09
AirdropsThe airdrop that asked for everything
A claim page went up at 13:05 UTC with a free token for anyone holding an NFT. Claiming took one signature. Behind it was a batch of setApprovalForAll calls, one for each collection in the wallet, all naming the same operator. By 17:48, 236 wallets had signed and lost 1,140 NFTs between them.
timeline utc
236 wallets in under five hours
- 13:05A bot account posts a holders-only airdrop in a collectors' chat, with a link and a countdown.
- 13:22The first wallet signs a batch the page built from the three collections it holds.
- 13:24The operator calls transferFrom on all three and moves that wallet's 12 NFTs.
- 15:10About 50 wallets an hour are signing, and the NFTs are listed below floor as they arrive.
- 17:48Moderators delete the post and the page goes offline, with most of the NFTs already sold.
Most of the victims used smart accounts, which show a batch of calls as one confirm with one fee. The page labeled the batch as a claim, and few people opened the list of calls inside it.
Nothing moved when they signed. An approval for all only changes who may move the NFTs, so a simulation that compares balances alone would have called the batch harmless.
what a check would have shown
The same request, read by Presign
- setApprovalForAll, not a claim
- Operator can move all 12 NFTs
- Operator deployed 40 minutes earlier
app.swapzone.exampleethereum · mainnet
3 flags03 / flagsapprove(spender, amount)
- Unlimited allowanceThe spender can move every USDC you hold, now or later.
- New contractThe spender was deployed 3 days ago.
- Unverified sourceIts code is not published, so nobody can read it.
A simulation shows what moves when you sign, and an approval moves nothing at that moment. So next to the balance change we show who can move your assets later.
