TLDR
- Scammers posed as artist Tyler Hobbs on X to promote a fake QQL NFT mint.
- Yuga Labs VP Quit said one person lost funds, while another was protected by Pocket Universe.
- The fake promotion reused details from QQL’s 2022 auction: 900 Mint Passes starting at 50 ETH.
- QQL has not reopened public minting, but existing pass holders can still mint official NFTs.
- QQL’s documentation lists the official Mint Pass contract address so buyers can verify it.
Scammers have impersonated generative artist Tyler Hobbs to promote a fake QQL NFT mint. At least one person has reportedly lost funds after interacting with the scheme.
The warning came on Oct. 20 from Quit, vice president of blockchain at Yuga Labs. He posted on X that several accounts were posing as Hobbs and falsely claiming minting had reopened.
“PSA QQL minting has not reopened,” Quit wrote. He said one person’s wallet had been drained, while another avoided a similar loss thanks to the Pocket Universe security tool.
The reported theft has not been independently verified. No wallet addresses, transaction details or loss estimates were shared.
Fake QQL Mint Reuses 2022 Auction Details
Posts on X show the impersonators promoted a Dutch auction of 900 QQL Mint Passes starting at 50 ETH. The messages claimed ties to the original creators, but the project’s official materials list no new auction.
Those figures match QQL’s real launch in September 2022. Hobbs and co-creator Dandelion Mané sold 900 passes through a Dutch auction that opened at 50 ETH.
That sale closed at 14 ETH per pass and sold out in under an hour. It raised 12,600 ETH, worth about $16.7 million at the time.
QQL lets collectors explore different outputs from a generative algorithm before choosing one to mint. Each Mint Pass can be used once to create an official NFT, and the pass is burned after use.
According to project documentation, Mint Passes do not expire. Existing holders can still mint official artwork, and Quit’s warning only concerned the false claim of a new public sale.
How the Wallet Drain May Have Worked
Quit’s post did not name the fake accounts or include screenshots. It also did not say whether the victim visited a fake website, approved a malicious contract or signed another type of request.
The FBI warned in an August 2023 advisory that criminals pose as NFT developers to steal crypto. Attackers may create lookalike social media accounts or take over real ones.
The agency said these posts often create a sense of urgency and send victims to fake websites. Once a wallet is connected, victims may approve transactions that let malicious contracts move their assets.
Similar methods have appeared in other recent incidents. On Oct. 5, security firm Salus flagged malicious USDG approvals linked to Revenue, where funds were moved in the same transaction that granted permission.
Some approvals stay active until the wallet owner revokes them. This can let a contract move assets long after the first interaction.
QQL’s documentation lists the official Mint Pass contract as 0xc73B17179Bf0C59cD5860Bb25247D1D1092c1088. Buyers can check this address on Etherscan before buying passes on secondary markets.
The project also warns that counterfeit Mint Pass collections exist. As of publication, it remains unclear exactly how the reported attack unfolded.
