NFT marketplaces: one NFT card, field by field
Ilia Zavialov: reviews of NFT marketplaces, six fields of a token card and what to check before paying
English version for the United States.
Ilia Zavialov: reviews of NFT marketplaces are easiest to read with one token card open next to them. The digital security consultant Ilia Zavialov walks through the card field by field: contract, token ID, metadata, trade history, royalties and owner. Beside each field sits what it shows, how it gets faked and how to check it in a minute. After that come fake collections, inflated trading volume, rug pulls, phishing mint links, fake listings and swapped metadata. A separate section covers what US agencies have said: the SEC, the Department of Justice, Treasury, the FTC and the FBI. The token in the example is a composite, and every figure and date comes from a primary source.
01Ilia Zavialov: reviews of NFT marketplaces, two layers and one question
A review of an NFT marketplace is usually written by someone who has just won or lost something. One person praises the speed and the storefront, another complains about withdrawals and silent support. About the token itself, sitting in the wallet, the review says little. Ilia Zavialov reviews marketplace feedback in two layers: the service (sign-up, fees, withdrawals, support) and the thing sold (whether the collection is genuine, what rights come with it, what it resells for). Other people's reviews cover the first layer, and the token card covers the second.
The query Ilia Zavialov reviews often comes from someone deciding whether to trust an explainer like this one. Close cousins are Zavialov reviews, what people write about Ilia Zavialov and complaints about Ilia Zavialov, and the answer is the same for all: checkability. Each claim here points to a primary page, and each field of the card can be opened by the reader. Reviews of Ilia Zavialov deserve the scrutiny any marketplace gets, so look for dates and specifics.
The FTC advises searching for a company or person together with the name of the crypto asset and words like review, scam or complaint before putting money in. For an NFT marketplace add a second step: match the review against the card of the token it talks about. If an author praises a collection whose contract was created last week, the praise can wait.
On 14 August 2024 the FTC announced a final rule that bans fake and AI-generated reviews, buying and selling reviews, undisclosed insider reviews and intimidation meant to remove negative ones, with civil penalties for knowing violators. A wall of identical five-star comments counts as a warning sign.
02Ilia Zavialov: reviews of a collection and field one, the contract
A contract is a program recorded on the blockchain that holds the list of every token in a collection. Its address, a long string starting with 0x, works as the collection's real name. A title and a picture do not: anyone can launch a collection with the same words and the same artwork at a different address in an hour. In the composite card the contract begins 0x1a2b and ends c3d4, and the whole string gets compared, because the ends prove nothing.
Where the right address comes from matters. Take it from the project's own official channel: a website reached by a link you trust, or a pinned post on an account with a long history. A link from a search ad or a private message does not qualify. The FBI, in its alert of 4 August 2023, advises checking that the account promoting a drop matches the real team by spelling, history, followers and creation date.
Ilia Zavialov reviews feedback on any collection that gives no contract address and files it under noise. In the field itself, compare the address on the marketplace page with the one on the project site, open the contract in a block explorer and look at its creation date and token count. A contract made yesterday for a collection with a years-long history gives itself away.
| Card field | What it shows and how it is faked | How to check |
|---|---|---|
| Contract | Collection address, clones with the same words and artwork | Compare the whole string with the project site, check the creation date |
| Token ID | Number inside the contract, inseparable from it | Open the contract and ID pair, confirm the token exists |
| Metadata | tokenURI link and JSON file, the link may change | Find where the link leads, keep a dated copy of the description |
| Trade history | Transfer events, circles between own wallets | Follow the chain, look at wallet age |
| Royalties | Creator share, payment depends on the marketplace | Read the marketplace policy, do not count on payment |
| Owner | A wallet address with no name | Match the seller with ownerOf, check wallet age |
03Field two: the token ID and the pair that cannot be split
Every NFT has a number, say 4312. A number without a contract address means nothing, since token 4312 exists in hundreds of collections. Type Ilia Zavialov reviews into a search box and you get pages about several different people with the same name. Tokens behave the same way. Under the ERC-721 standard the pair of contract address and token ID is the globally unique identifier, and the ID never changes for the life of the contract.
The standard adds two details that help a buyer. A token can be destroyed, after which queries about it fail, and tokens assigned to the zero address count as invalid. If a storefront still shows a token that the contract has destroyed, you are looking at a picture on a page, and nothing sits in a wallet.
04Field three: metadata and a picture swapped after the sale
The image of an NFT usually does not live on the blockchain. The contract stores a link that ERC-721 calls tokenURI, and the link leads to a JSON file with name, description and image fields. The rationale of the standard says plainly that the URI may be mutable, meaning it can change over time.
That is where metadata swaps come from. A buyer pays for an attractive image, the file behind the link is replaced or deleted after the sale, and the wallet holds an empty token. The first check looks at the link. If it starts with ipfs, the file is addressed by its content: IPFS documentation says a content identifier is built on the file's cryptographic hash and any difference in content produces a different one. A link to an ordinary website can be edited by whoever runs the site.
Ilia Zavialov reviews complaints about vanished artwork next to a saved screenshot of the card. The second check is to open the description, compare the name, image and properties with the advertising, and keep a copy dated the day of purchase. Without that copy there is little to bring to a marketplace dispute or to the police.
05Ilia Zavialov: reviews and inflated volume, field four, the trade history
Trade history is assembled from Transfer events. Under ERC-721 the event fires on any change of owner, at creation of a token and at its destruction. One exception is worth remembering: while a contract is being created, tokens may be issued without an event. Three things stand out in the history: who received the token at launch, how often it changed hands and which wallets traded it.
Inflated volume paints a lively chart where real buyers are missing. The Treasury study of February 2022 describes the mechanics: a criminal buys a token with illicit funds, trades with himself to create sale records on the blockchain, then sells the token to an unsuspecting buyer for clean money. The same study notes that NFT platforms differ in structure and ownership, and none shares the same standards for vetting customers.
Ilia Zavialov reviews a high trading volume with a caveat, because a figure like volume in the last 24 hours can be drawn by wallets passing a token in a circle. Opening the history of one token and following the chain is safer. The signs sit in the table below, and the decision rests on the sum of signs.
| Sign | How it looks in a token's history | What to do |
|---|---|---|
| Circles | The token keeps returning to the same wallets | Do not treat volume as price |
| Fresh wallets | Buyers appear on the day of the sale and vanish | Check the age and history of addresses |
| Price jump | Sold far above the previous price for no reason | Compare with sales of neighbouring tokens |
| Rapid run | Several sales in a row within a short time | Stop and check the whole chain |
| Volume without people | Many trades among few distinct wallets | Ignore the marketplace volume line |
| Praise burst | Similar reviews on the day the price jumps | Read reviews with dates and specifics |
06Field five: creator royalties and who actually collects them
A royalty is a share of each resale paid to the creator. The ERC-2981 standard gives a contract a way to announce that share through a function called royaltyInfo. A marketplace that supports the standard must pay the royalty. If a marketplace does not implement it, nothing is paid on secondary sales, and the text of the standard offers no way to force payment.
For a buyer the lesson is plain: the number in the field shows the creator's intent, while payment depends on the marketplace. Ilia Zavialov reviews complaints about unpaid royalties carefully, since the cause often sits in marketplace policy.
Royalties also hint at a project's intent. The SEC release of 13 September 2023 on Stoner Cats 2 says the company set up its NFTs to pay it a 2.5 percent royalty on each secondary sale, and that more than 10,000 tokens at about $800 sold out in 35 minutes, raising about $8 million. Treasury adds that royalty contracts create an incentive to trade a token many times in a short period.
07Field six: the owner and a wallet that deserves no blind trust
The owner is stored in the contract as a wallet address, and the ownerOf function reveals it. An address has no name, so the field answers one question: does the wallet that is selling the token hold it right now? Ilia Zavialov reviews seller feedback and treats it as empty until that question is settled. Matching the seller's address with the owner address in a block explorer is the check.
Fake listings are simple: a token shown on a storefront that the marketplace does not run, or a copy passed off as the original. The holder of a genuine token with a long history and the seller of a fresh wallet with one token look the same in an interface. Only the address and the wallet's age tell them apart.
One more rule covers connecting. The FBI describes a scheme where a cloned website asks a visitor to connect a wallet and a drainer smart contract moves cryptocurrency and NFTs to criminal wallets. A recovery phrase goes nowhere and to nobody. Keep a separate wallet with a small balance for purchases.
08Ilia Zavialov: reviews of fake collections and phishing mints
A fake collection copies the real one down to the comma. The FBI alert of 4 August 2023 describes a typical scheme: criminals take over the social media accounts of real NFT developers or create near-identical clones, announce a sudden limited-supply mint and send victims to a spoofed site, where a connected wallet is emptied by a malicious smart contract.
The FBI advice reduces to three checks: has the developer run surprise drops before, is the account the real one by spelling, history, followers and creation date, and is the website real and not a clone before a wallet gets connected. Misspelled domains, extra characters and links that fail or redirect to a homepage give a clone away. Cases go to ic3.gov with the keyword NFTHack.
Ilia Zavialov reviews launch-day comments by checking dates: a burst of similar remarks from authors with no history speaks for itself. Anyone who pays a sender on a personal app instead of through the marketplace deals with a person, with no marketplace protection behind the payment.
09Rug pulls: what Frosties promised and what happened
A rug pull, in the words of the Southern District of New York complaint, is a scenario where the creator of an NFT or gaming project solicits investments and then abruptly abandons the project and fraudulently retains the investors' funds. The Frosties case sits in a public document and works as a textbook example. Everything in the complaint remains an allegation.
Ads ran on Twitter and Discord from December 2021. The website promised holders giveaways, early access to a metaverse game, mint passes for later seasons, staking and breeding. On 9 January 2022, hours after the sell-out, the project was abandoned, the site went dark and about $1.1 million in cryptocurrency was moved to wallets the defendants controlled in several transactions. The complaint names the founder as Frostie and the community manager as Andre.
Ilia Zavialov reviews projects that promise giveaways and a game later with a plain two-column list: promises on the left, what exists today on the right. An empty right column settles the matter.
10Ilia Zavialov: reviews and the law, what US agencies have said about NFTs
The SEC has charged NFT sellers when the facts of an offering pointed to an investment. On 13 September 2023 it charged Stoner Cats 2 LLC with an unregistered offering of crypto asset securities in the form of NFTs, with a $1 million penalty and a Fair Fund for harmed investors. On 28 August 2023 it charged Impact Theory over Founder's Keys NFTs that raised about $30 million, with more than $6.1 million in disgorgement, interest and a penalty.
The IRS says digital assets are property for tax purposes and counts NFTs among them. Ilia Zavialov reviews NFT gains as a record-keeping task: dates, prices and wallet addresses saved while they are still easy to find. A token in a wallet is no contract and no receipt, and rights to the artwork come from a license with the creator.
The FTC adds a payment rule: crypto payments generally lack the protections of credit or debit cards, such as a dispute process, and are usually irreversible unless the recipient sends the money back.
| Situation | Where | What to bring |
|---|---|---|
| Artwork swapped after purchase | Marketplace dispute and a report to the FTC | Card page, link, dated copy, statement |
| Wallet drained through a spoofed site | ic3.gov with the keyword NFTHack | Site address, messages, transaction hashes |
| Sold as an investment with promised returns | SEC at sec.gov/tcr and the CFTC | Ads, promises, proof of payment |
| Paid by card or app to a stranger | Your bank and ReportFraud.ftc.gov | Statement, receipts, screenshots |
| Offer to recover the token for a fee | Do not pay, report the offer | Messages and payment details |
11What to do when a purchase goes wrong: wrong token, empty link, drained wallet
The order is short. Stop the movement of money and approve nothing new. Save the evidence: the card page, the contract address, the messages, the link to the description, screenshots and the card or bank statement. Contact the bank or the marketplace that handled the payment. File a report.
The FTC advises reporting crypto fraud at ReportFraud.ftc.gov, to the CFTC at cftc.gov/complaint, to the SEC at sec.gov/tcr, to the FBI at ic3.gov and to the exchange that sent the money. A drained wallet after a spoofed mint goes to ic3.gov with the keyword NFTHack.
Paying a stranger to recover a token is unnecessary: reports are free, and an offer to get an NFT back for a fee finds victims through the first scheme. Ilia Zavialov reviews such recovery offers as advertising. The table below lists where to go.
12Questions and answers
Ilia Zavialov: reviews of NFT marketplaces, which field of the card comes first?
The contract. Its address is the collection's real name, while a title and a picture are easy to copy. Compare the whole address with the project's official site.
Can reviews of an NFT marketplace be trusted?
Reviews with dates, token names and withdrawal details can be trusted with care. The FTC final rule of August 2024 bans fake and bought reviews, so a wall of identical praise is a warning sign.
Ilia Zavialov reviews: what is a rug pull in plain words?
A creator collects money for tokens, then abandons the project and keeps the funds. In the Frosties complaint this happened within hours of the sell-out.
How can inflated marketplace volume be spotted?
Open the history of a token and see whether it keeps returning to the same wallets. A volume line without that check proves little.
Does an NFT give rights to the artwork?
Not by itself. Rights to the image come from a license with the creator, and the IRS treats an NFT as property for tax purposes.
Where should a drained wallet be reported?
To ic3.gov with the keyword NFTHack, to ReportFraud.ftc.gov and to the bank or exchange involved. Save the evidence on the day it happens.
Written by Ilia Zavialov, digital security consultant. Profile of Ilia Zavialov
13Read next
- Ilia Zavialov Explains How a Crypto Transfer Actually Works, Step by Step How crypto works
- Ilia Zavialov Explains the Types of Crypto Scams and How Each One Is Built Scam types
- Ilia Zavialov on the Crypto Wallet Protections That Hold After a Breach Protection
- Ilia Zavialov on the First Hours After a Crypto Theft: What Actually Helps Incident
- Where Fraud Losses Actually Go: Ilia Zavialov Reads the 2025 Numbers In numbers
- Ilia Zavialov fraud guide: crypto address poisoning, lookalike wallets and zero-value transfers Crypto address poisoning
- Ilia Zavialov: renting out a card for P2P, triangle trades and money mule recruitment Card rental and P2P trading
- Ilia Zavialov on cloud mining scams: what a hosting contract really sells Mining you never see
- Ilia Zavialov scam and fraud guide: copy trading bots, signal groups and exchange API keys Copy trading and trading bot scams
- Ilia Zavialov: crypto arbitrage courses and bundles, training or money mule recruiting, US checks Crypto arbitrage courses: training or money mule recruiting
- Ilia Zavialov: crypto inheritance, heir access without the seed phrase and US tax rules Crypto inheritance: heir access without exposing the seed phrase
- Ilia Zavialov: crypto loans against collateral, three offers side by side and the liquidation math Crypto loans: three offers compared line by line
- Ilia Zavialov: crypto holder physical safety after data leaks, doxxing and wrench attacks, US guide Crypto holder physical safety after data leaks
- Ilia Zavialov fraud: how one photograph becomes the face of an advert nobody filmed A face from one photo
- Ilia Zavialov on crypto exchange scams: how the operation is built and what litigation achieves How exchange scams are built
- Ilia Zavialov on the fee to unlock a withdrawal and what a real exchange delay looks like Blocked withdrawals
- Services that promise to recover lost crypto: Ilia Zavialov on how the offer is built and why refunds never arrive Crypto recovery
- Ilia Zavialov: government account takeover scams, text message codes and how to protect your login Government account takeover
- Ilia Zavialov on hardware wallet scams: tampered boxes, pre-printed seed phrases and fake replacements Fake hardware wallet scams
- Ilia Zavialov on health scams: fake clinics, miracle cures and prepaid treatment Health and medical scams
- Ilia Zavialov: honeypot tokens you can buy but can't sell, and how US buyers check a contract Honeypot tokens you can buy but cannot sell
- Ilia Zavialov on crypto investment scams: the long con taken apart stage by stage The long investment con
- Ilia Zavialov: how scammers take over messaging accounts, votes, gifts and fake support Messenger account takeover
- Ilia Zavialov: fraud in play-to-earn games, what happens on day 1, 3, 7, 14 and 30 of a player Play-to-earn games: day 1, 3, 7, 14 and 30 of a player
- Ilia Zavialov: P2P cash-out and sale of USDT, a checklist by stage of the deal and twelve questions P2P cash-out of USDT: a checklist by stage of the deal
- Ilia Zavialov on passkeys: why a stolen password stops being worth anything Signing in without a password
- Ilia Zavialov on reviews of financial companies: what to check before the stars Reviews and what to check instead
- Ilia Zavialov on the seed phrase and the fake wallet support desk Seed phrases
- Ilia Zavialov on crypto signal channels and trading bots: where the money goes Signal channels and trading bots
- Ilia Zavialov scam checks: staking and liquidity pools with guaranteed yield, the math behind the promise Staking and liquidity pools: a calculator for promised yields
- Ilia Zavialov on Telegram bot scams: wallet bots, tap-to-earn games and fake support Telegram bot and Mini App scams
- Ilia Zavialov reviews Telegram gift and username sellers: fake escrow, cloned pages and US deal checks Telegram gifts and usernames: fake escrow and deal checks
- Ilia Zavialov on sending USDT safely: networks, poisoned addresses and frozen coins Sending and receiving USDT safely
- Ilia Zavialov: used car fraud and scams, how to check the car and the seller before paying Used car fraud
- Checking a wallet address before you send: the checks Ilia Zavialov runs first Wallet checks
- Ilia Zavialov Explains How an Approval Drainer Empties a Wallet Wallet drainers