Fake NFT whitelist / mint wallet-drain phishing — fraudulent email claims the recipient's wallet has been whitelisted or allowlisted for an exclusive NFT mint, presale drop, or free NFT claim, then directs them to connect MetaMask, Trust Wallet, or Phantom to a malicious portal that drains all crypto and NFTs via a malicious smart contract; some variants request the seed phrase directly
fake-nft-whitelist-mint-wallet-drain-phish
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Phishing emails impersonating NFT projects claiming the recipient's wallet has been whitelisted or allowlisted for an exclusive NFT mint, presale drop, or free NFT claim — directing them to connect MetaMask, Trust Wallet, Coinbase Wallet, or Phantom to a malicious portal within a tight deadline. The "connect wallet" flow triggers a malicious smart contract that drains all crypto and NFTs via a blanket approval transaction (setApprovalForAll). More aggressive variants request the seed phrase directly under the guise of "verifying wallet ownership" — an immediate account takeover. Key facts: (1) Chainalysis 2023: NFT wallet-drain attacks accounted for $100M+ in annual losses; seed phrase theft is effectively irreversible — no blockchain transaction can be undone; (2) The NFT boom of 2021–2022 created a persistent "whitelist culture" where early-access notifications from projects are expected, making these lures highly credible to NFT community members; (3) Legitimate NFT platforms (OpenSea, Blur, MagicEden, Foundation) never notify users of whitelist spots by email and never ask for wallet connections or seed phrases via email; (4) Real whitelist notifications come through Discord servers and official project websites — email is not an NFT project standard. Warning signs: any email requesting MetaMask connection or a seed phrase, "whitelist confirmed" or "free mint" language from an unknown project, deadline urgency ("claim in 24 hours"), sender domain not matching any known NFT platform.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits over 1,800 signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 1,800+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started