Tyler Hobbs Impersonators Drain Wallet Through Fraudulent QQL Mint Pass Auction

TLDR

• Fraudsters created fake accounts mimicking generative artist Tyler Hobbs to advertise a nonexistent QQL NFT auction.
• At least one collector had their wallet drained, according to Yuga Labs VP Quit, though another was saved by Pocket Universe.
• The fraudulent campaign recycled information from QQL’s genuine 2022 sale: 900 passes with a 50 ETH starting price.
• No new public minting has launched, though current pass holders retain the ability to create official NFTs.
• Official contract addresses are published in QQL’s documentation for verification before purchasing passes.

Criminals have launched a phishing operation targeting NFT collectors by impersonating generative artist Tyler Hobbs and falsely advertising a new QQL mint. At least one individual has reportedly suffered financial losses after falling victim to the scheme.

The alert was issued on Oct. 20 by Quit, who serves as vice president of blockchain at Yuga Labs. He shared on X that multiple fraudulent accounts were masquerading as Hobbs and incorrectly announcing that minting had resumed.

“PSA QQL minting has not reopened,” Quit stated. He confirmed that one individual’s wallet had been compromised, while a second potential victim was shielded from harm by the Pocket Universe security application.

The alleged theft has not received independent confirmation. No specific wallet addresses, blockchain transaction records, or monetary loss figures were disclosed.

Fraudulent Campaign Mirrors 2022 Launch Parameters

Messages circulating on X show the imposters advertised a Dutch auction offering 900 QQL Mint Passes with an opening price of 50 ETH. The communications falsely suggested affiliation with the original development team, though official project channels contain no announcements of any new auction.

These specifications precisely mirror QQL’s legitimate debut in September 2022. Hobbs and collaborator Dandelion Mané conducted a Dutch auction sale of 900 passes that began at 50 ETH.

That authentic sale concluded at 14 ETH per pass and reached full capacity in less than 60 minutes. The auction generated 12,600 ETH, valued at approximately $16.7 million during that period.

QQL enables collectors to preview various outputs generated by an algorithm before selecting one to permanently mint. Each Mint Pass grants a single-use authorization to create an official NFT, after which the pass undergoes burning.

According to project documentation, Mint Passes carry no expiration date. Current holders maintain the ability to mint official artwork, and Quit’s advisory specifically addressed the fraudulent announcement of a new public offering.

Potential Attack Vector Remains Undisclosed

Quit’s announcement did not identify the fraudulent accounts by username or provide visual evidence. It also left unspecified whether the victim accessed a counterfeit website, authorized a harmful smart contract, or signed alternative malicious requests.

The FBI issued guidance in August 2023 warning that criminals frequently impersonate NFT creators to steal cryptocurrency. Attackers may construct duplicate social media profiles or compromise legitimate accounts.

The bureau noted these campaigns commonly employ urgency tactics and direct victims toward fraudulent websites. After connecting their wallet, victims may grant approvals enabling malicious contracts to transfer their holdings.

Comparable techniques have surfaced in other recent incidents. On Oct. 5, security company Salus identified harmful USDG approvals connected to Revenue, where assets were transferred within the same transaction that established permissions.

Certain approvals remain functional until explicitly revoked by the wallet owner. This can allow a contract to move assets well beyond the initial interaction.

QQL’s documentation specifies the official Mint Pass contract as 0xc73B17179Bf0C59cD5860Bb25247D1D1092c1088. Purchasers can verify this address through Etherscan before acquiring passes on secondary marketplaces.

The project additionally cautions that counterfeit Mint Pass collections are in circulation. As of this writing, the precise mechanics of the reported attack remain unclear.