A new study published in Blockchain: Research and Applications on June 25, 2025, reveals significant security vulnerabilities within the non-fungible token (NFT) ecosystem. This is the beginning of an important study done by researchers from Huazhong University of Science and Technology and Peking University. This study is the first systematic SoK of NFT security. The team deeply reviewed 248 security reports and 35 academic papers. Through this process they identified 12 primary threat vectors and documented 176 NFT security incidents.
The study sheds light on the most varied attack vectors that have been plaguing the NFT space. Smart contract bugs are an overpowering threat. Reentrancy bugs and access control issues can allow for attackers to exploit contracts and drain funds.
Market manipulation tactics such as wash trading and rug pulls are extremely common, further putting investors at risk. Furthermore, attacks on our critical infrastructure, such as phishing campaigns, fake service provider interfaces, and website exploits persist, tricking users and putting their information at risk.
The report revealed that attackers have made off with the millions by seeking out and exploiting vulnerabilities in popular minting functions. On the third point, scammers have already scored big by duping users into buying fraudulent tokens associated with celebrity names. It shows how bad the issue has gotten.
Our model consists of the contract layer, market layer, and auxiliary service layer. It provides a sophisticated, yet intuitive, framework to identify, assess and reduce risk at all levels of the NFT landscape.
"Despite the explosive growth of NFTs, the community has lacked a comprehensive understanding of where and how these systems fail." - Dr. Haoyu Wang
The study’s findings highlight the overwhelming need for better security practices and protections in this new NFT world. We need developers, platforms, and users to protect these vulnerabilities and not leave the integrity of the ecosystem to chance.
"Our work bridges this knowledge gap by not only exposing the root causes of major attacks but also offering developers and researchers the tools to detect and prevent them. This is a call to action—for academia and industry alike—to take NFT security seriously." - Dr. Haoyu Wang
