Account Takeover Scams Impersonating OpenSea Support
Fraudsters impersonating OpenSea's support team trick NFT sellers into 'verifying' their accounts through phishing pages that capture wallet signatures, enabling thieves to drain NFT collections.
Part of: Account Takeover Scams
Last reviewed: 8 June 2026
OpenSea users who have listed valuable NFTs for sale are high-value targets for account takeover attacks. Scammers impersonating OpenSea support contact sellers via email or Discord, warning that their listing violates a policy, that their account has been flagged for unusual activity, or that they must complete a mandatory 'seller verification' to keep their listings active.
The verification page is a pixel-perfect clone of OpenSea's interface, prompting users to connect their wallet and sign a 'verification message.' The message is actually an EIP-712 signature or a setApprovalForAll transaction that grants the attacker the right to transfer NFTs from the victim's wallet.
OpenSea communicates with users through official emails from @opensea.io, through in-platform notifications, and through its official Discord server. OpenSea does not send unsolicited messages demanding wallet re-verification outside these channels, and no legitimate verification step requires signing a new approval for an unfamiliar contract.
How this scam works on the OpenSea brand
The phishing email arrives with a subject line such as 'Important: Your OpenSea Seller Account Requires Verification' and includes OpenSea's logo and a case reference number. It warns that listings will be removed unless verification is completed within 48 hours.
The linked verification portal shows the user's NFT collection — scraped from the public blockchain — alongside a prompt to 'verify ownership' by connecting their wallet and signing a message. The signing request submitted through MetaMask or WalletConnect contains a setApprovalForAll or permit signature that transfers control of the NFT collection to the attacker's address.
Alternatively, some variants present a fake OpenSea login page that harvests email and password, then re-directs users to a wallet connection step. With both credentials and wallet approval, the attacker can delist and relist the victim's NFTs at artificially low prices and immediately purchase them from their own account.
Common red flags
- Email sender is not exactly @opensea.io — check for opensea-security.com, opensea-support.net, and similar
- Verification requires connecting your wallet and signing a new approval outside the actual opensea.io website
- Message was received via Discord DM from an account claiming to be OpenSea — OpenSea staff are identifiable in the official Discord and do not cold-DM users
- Verification portal URL is not opensea.io
- Signing request contains setApprovalForAll or an unlimited ERC-20/NFT approval for an unfamiliar contract
- Urgent deadline language — 'listings will be removed in 24 hours unless you act'
How to protect yourself
- Verify any OpenSea notification by logging directly into opensea.io — do not click links in emails or Discord DMs
- Enable two-factor authentication on your OpenSea account and on the email address linked to it
- Before signing any wallet approval from what claims to be OpenSea, verify the contract address on Etherscan against OpenSea's official Seaport contract
- Regularly revoke unnecessary NFT approvals via revoke.cash to limit exposure
- Use a hardware wallet for high-value NFT collections so all approvals require physical device confirmation
How to report it
- Report the phishing email and domain to OpenSea at [email protected] and via opensea.io/safety
- Report the phishing domain to Google Safe Browsing and submit it to MetaMask's phishing list
- File a report with IC3.gov (US) or Action Fraud (UK)
- If NFTs were transferred, immediately contact OpenSea support to flag the stolen items so they can be frozen if re-listed
Frequently asked questions
Does OpenSea ever require sellers to re-verify their wallets?
OpenSea does not send unsolicited emails or Discord DMs requiring wallet re-verification. Legitimate account actions are handled through the opensea.io interface itself. Any external verification request is a scam.
How quickly can NFTs be resold after being stolen through this method?
Very quickly. Once a setApprovalForAll approval is granted, attackers can transfer and list NFTs within minutes. Contact OpenSea support immediately if you suspect theft so they can freeze re-listing of the stolen items.
Can I recover NFTs stolen through a fake OpenSea verification?
OpenSea can freeze stolen NFTs from being listed on its platform, but blockchain transfers themselves are irreversible. Acting quickly to report to OpenSea maximizes the chance of preventing resale.