5 P2P NFT Trading Scams on Solana (And How Escrow Stops Them)
Peer-to-peer NFT trades on Solana carry serious risks — from wallet drainers to fake-buyer scams. Learn the five most common attack vectors and how trustless escrow eliminates them.
Why P2P NFT Trading Is a High-Risk Activity
Solana's NFT ecosystem is fast, cheap, and increasingly liquid — but that accessibility cuts both ways. The same frictionless environment that lets you trade a compressed NFT for pennies in gas also makes it trivially easy for scammers to operate at scale. In a marketplace with no guaranteed counterparty trust, someone always has to go first.
That's where most losses happen.
Peer-to-peer NFT trades — the kind arranged directly between buyers and sellers via Discord DMs, Telegram groups, or OTC channels — bypass the safety rails that centralized marketplaces provide. No dispute resolution. No fraud monitoring. No recourse when things go wrong.
Understanding how these scams work is the first step to avoiding them. Here are the five most common attack vectors active on Solana in 2025–2026 — and exactly how trustless escrow neutralizes each one.
Scam #1: The Wallet Drainer Via Fake Trade Site
How it works:
You're negotiating a trade in Discord. The counterparty sends a link to what looks like a legitimate NFT trading platform. The site asks you to connect your wallet and sign a transaction to "initiate the trade." The moment you sign, your NFTs, SOL, and SPL tokens are swept to a drainer wallet controlled by the attacker.
Drainer malware on Solana has become increasingly sophisticated. Tools like Rainbow Drainer and its successors can batch-drain multiple asset types in a single transaction — NFTs, liquid staking tokens, and SOL rent deposits included. Blockchain forensics firm Scam Sniffer documented $4.17 million stolen from nearly 4,000 Solana users via this exact vector.
Why it works:
Phantom and other Solana wallets show transaction details, but most users don't parse the raw instruction data before signing. A malicious transferChecked or setAuthority instruction buried in a complex transaction can transfer ownership of every asset in your wallet before you realize what happened.
How escrow stops it:
A legitimate trustless escrow protocol never asks you to sign a transaction that transfers assets to an unknown party. The smart contract is open-source and audited. You deposit into the escrow — not into someone's personal wallet. The counterparty sees your deposit on-chain before committing their own assets. There is no phishing URL because the trade mechanics live on the blockchain itself, not on a third-party website.
Scam #2: The "You Go First" Fake Buyer
How it works:
A buyer approaches you in an NFT trading channel offering to purchase your high-value NFT at or above floor price. They seem legitimate — an aged account, mutual connections, posted portfolio. They ask you to send the NFT first so they can "verify authenticity," promising to send payment immediately after.
You send the NFT. Payment never comes. The account disappears.
This is the oldest trade scam in existence, digitized. The Solana variant is especially dangerous because transactions are final and irreversible in seconds.
Why it works:
Social proof is easily fabricated. Discord accounts can be aged and filled with plausible activity. References can be faked or coached. Urgency is manufactured ("I'm only buying today, other sellers are waiting"). The scammer exploits the fundamental trust problem in any bilateral trade: one party must extend credit first.
How escrow stops it:
Neither party sends anything directly to the other. The seller deposits the NFT into the escrow contract. The buyer deposits SOL or SPL tokens. Only when both deposits are confirmed on-chain does the contract execute the simultaneous swap. There is no "you go first." The trustless contract is the neutral third party — and it has no incentive to cheat.
Scam #3: Compressed NFT (cNFT) Airdrop Drainers
How it works:
You receive an unexpected NFT airdrop in your Phantom wallet. It looks valuable — the image shows a well-known collection. A message on the NFT's metadata directs you to a "claim site" where you can receive additional rewards. You visit the site, connect your wallet, sign a transaction — and your wallet is drained.
Compressed NFTs (cNFTs) on Solana can be minted and airdropped in bulk for fractions of a cent per token. This makes them the perfect spam vector for phishing campaigns. Scam Sniffer noted that Solana's ecosystem historically lacked a blacklist mechanism for blocking malicious cNFTs from appearing in wallets, allowing campaigns to run indefinitely without deploying new contracts.
Why it works:
Humans are wired to investigate free things. An unexpected NFT airdrop triggers curiosity and FOMO simultaneously. The malicious metadata is indistinguishable from legitimate project links at first glance. Wallet UIs display the image prominently; the danger is buried in the transaction details.
How escrow stops it:
Escrow doesn't directly prevent cNFT phishing — that's a wallet-level defense problem. But it does protect you during the trade execution phase. If you're arranging a trade involving NFTs you received and want to verify, a legitimate counterparty using escrow means you can confirm the exact token mint addresses being traded before either side commits funds. There's no pressure to "sign now" on an external site.
Scam #4: The Bait-and-Switch Token Swap
How it works:
You agree to trade your NFT for a specific SPL token — say, a mid-cap DeFi token with real liquidity. The counterparty creates a token with an identical name and ticker, mints it fresh, and includes it in the trade transaction instead of the legitimate token. You approve the swap, receive worthless tokens, and your NFT is gone.
SPL token creation on Solana costs almost nothing. There is no global registry preventing duplicate names or tickers. The real token and the fake token look identical in wallet UIs that display only metadata — not mint addresses.
Why it works:
Most users don't verify mint addresses during P2P trades. The fake token may even appear in your wallet with the correct logo if the scammer copies the metadata URI from the legitimate token's mint. By the time you try to sell, you discover the liquidity doesn't exist.
How escrow stops it:
A well-designed escrow contract requires both parties to specify exact mint addresses as trade terms before either deposit is made. The contract enforces that what the buyer deposits matches what was agreed — down to the mint address, not just the token name. If the buyer attempts to substitute a different mint, the contract rejects the deposit. The seller can verify the specified mint address against official sources before committing their NFT.
Scam #5: The Partial Fill / Incomplete Trade Manipulation
How it works:
In more complex multi-asset trades (e.g., three NFTs for two tokens plus SOL), the counterparty structures the transaction to transfer your assets while only partially fulfilling their side. They may exploit wallet UI limitations that display totals rather than line items, or construct a transaction where their "payment" is a near-worthless asset bundled with legitimate ones.
This is a technically sophisticated scam that targets experienced traders who have their guard up against obvious drainers but may not scrutinize complex transaction structures carefully.
Why it works:
Complex transactions are hard to audit in real time. Wallet simulators show expected state changes, but a malicious counterparty can structure transactions to look legitimate in simulation while exploiting edge cases in execution. The time pressure of OTC deals ("price is only good for 10 minutes") reduces scrutiny.
How escrow stops it:
Escrow contracts enforce atomic swaps. Either the complete set of agreed assets transfers simultaneously, or nothing transfers at all. There is no such thing as a partial fill in a properly designed escrow. The trade terms — every asset, every quantity, every mint address — are encoded in the contract at initiation and cannot be modified without canceling the escrow entirely.
The Common Thread: Who Has to Trust Whom?
Every scam on this list exploits the same underlying vulnerability: asymmetric trust in a trustless environment. One party is forced to extend some form of credit — whether that's sending an asset first, clicking a link, or signing an unverified transaction — before the counterparty has committed anything.
Trustless escrow eliminates asymmetric trust entirely. The contract holds both parties' assets simultaneously. Neither party can run with the other's funds because the contract only releases assets when all conditions are met. The "trust" is outsourced to audited code on an immutable ledger.
Practical Checklist Before Any P2P Trade
If you're trading outside a centralized marketplace, apply this checklist before committing anything:
- Verify the escrow contract is open-source and audited. Any legitimate P2P trading tool should link to its program ID on Solana Explorer and its audit report.
- Confirm mint addresses, not just names. Cross-reference against official collection pages or token registries.
- Never sign a transaction from a URL you didn't navigate to intentionally. Links in DMs are not safe.
- Never interact with airdropped NFTs. If you didn't request it, don't click the metadata link.
- Use a hardware wallet for high-value trades. Ledger + Solana requires physical confirmation for every signature.
- Revoke unused token approvals regularly. Tools like step.finance allow you to audit and revoke open approvals.
- If a counterparty refuses to use escrow, walk away. Legitimate buyers have no reason to avoid atomic settlement.
The Bottom Line
Solana's speed and low fees have made it the premier destination for NFT trading — and that same accessibility has attracted a sophisticated ecosystem of scammers. The five vectors above account for the vast majority of P2P trade losses on the network.
The solution isn't to avoid P2P trading. It's to insist on the same guarantee that every legitimate financial system provides: simultaneous, atomic settlement with no trusted intermediary. That's what trustless escrow delivers — and why it should be the default for any non-custodial NFT trade.
Related Reading
- SPL Tokens Explained: The Complete Guide to Solana's Token Standard — Understanding the token standard that underpins every NFT you trade
- What Is NFT Escrow and Why It Matters for Safe Trading — Foundational explanation of trustless escrow
- Smart Contract Security: What Every NFT Trader Should Verify — How to vet any escrow protocol before using it