Scammers impersonate Tyler Hobbs in fake QQL NFT mint scheme

Scammers have reportedly impersonated generative artist Tyler Hobbs to promote a fake QQL NFT mint, with reports suggesting that at least one person has lost funds after interacting with the scheme.

In an Oct. 20 post on X, Yuga Labs VP of blockchain Quit (@0xQuit) warned that several accounts were posing as Hobbs and falsely claiming that minting had reopened for the Ethereum-based generative art project.

“PSA QQL minting has not reopened,” Quit wrote, adding that he was aware of one person whose wallet had been drained and another who avoided a similar outcome because of the Pocket Universe security tool.

PSA QQL minting has not reopened. Already aware of one person who got drained and one who would've if not for pocket universe.

Scammer is making several accounts impersonating Tyler Hobbs. Please do not interact.

— Quit (@0xQuit) October 19, 2026

The researcher urged users not to interact with the impersonating accounts. The reported theft has not been independently verified, and no wallet addresses, transaction hashes or estimates of the stolen funds were provided in the warning.

According to posts circulating on X, the impersonators promoted a supposed Dutch auction involving 900 QQL Mint Passes with a starting price of 50 ETH.

The messages claimed that the offering was connected to partnerships involving the original creators, although no such new auction was established by the project’s official materials.

The reported promotion used details associated with QQL’s original 2022 launch, when 900 Mint Passes were sold through a Dutch auction that began at 50 ETH.

Fake QQL mint is reusing details from the 2022 auction

QQL was created by Tyler Hobbs and Dandelion Mané as a collaborative generative art project that allows collectors to participate in selecting the artwork included in its official NFT collection.

According to the project’s official documentation, QQL Mint Passes give holders the right to turn a selected output from the generative algorithm into an official NFT.

The collection was designed around 999 passes, with each pass allowing its owner to mint one artwork. Once used, the pass is burned, and the resulting NFT becomes part of the permanent collection.

Unlike conventional NFT releases, where buyers receive artwork generated at the time of purchase, QQL allows collectors to explore different outputs before deciding which one to mint.

Hobbs and Mané launched the project in September 2022, offering 900 passes to the public while reserving the remaining 99 for other purposes.

The original Dutch auction began at 50 ETH and closed at 14 ETH per pass after selling out in less than an hour.

The sale generated 12,600 ETH, valued at approximately $16.7 million at the time, according to contemporary reporting by Crypto Briefing and The Block.

QQL’s auction used a rebate mechanism that allowed successful participants to pay the final clearing price, even if they initially bid at a higher level.

The figures associated with the reported impersonation attempt match the original auction’s supply and opening price. However, the available evidence does not establish whether the attackers copied the entire 2022 promotion or reused only those details.

The official project documentation says Mint Passes do not expire and can be used at any time to create new QQL artwork.

Existing pass holders can therefore continue minting official NFTs through the project’s established system. Quit’s warning concerned the claimed reopening of a public mint, not the normal process available to existing pass holders.

The official QQL website continues to display artwork created through the project, while its documentation directs collectors to verified resources for minting and obtaining passes.

QQL’s documentation warns that counterfeit Mint Pass collections exist and tells buyers to check official links before purchasing.

Tyler Hobbs impersonation warning follows reported wallet drain

Quit’s October 20 warning identified account impersonation as the method being used to promote the supposed QQL offering.

The researcher said the scammer had created several accounts pretending to represent Hobbs, although the post did not identify the accounts or provide screenshots of the fraudulent messages.

One person reportedly lost funds, while another avoided a wallet drain after receiving protection from Pocket Universe, according to Quit.

The warning did not explain which transaction triggered the reported protection or whether the affected user had visited a counterfeit website, approved a malicious contract or signed another type of authorization.

As of the publication time it is unclear how the attack unfolded.

The Federal Bureau of Investigation has previously warned that criminals impersonate NFT developers to promote fraudulent releases and steal cryptocurrency from collectors.

In an August 2023 advisory, the agency said attackers sometimes create social media accounts that closely resemble legitimate project profiles or compromise existing accounts belonging to NFT developers.

According to the report, fraudulent promotions may use deceptive tactics designed to create a sense of urgency and encourage users to act quickly.

Per the bureau, such posts can direct victims to counterfeit websites that resemble official NFT project pages.

After connecting their wallets, victims may be asked to authorize transactions that give malicious smart contracts access to their cryptocurrency or NFTs.

The agency warned that attackers can use those permissions to transfer assets from victims’ wallets without their understanding of the transaction’s actual purpose.

Similar attack vectors have appeared in a number of recent cryptocurrency security incidents.

On Oct. 5, researchers at Salus identified malicious USDG approvals connected to Revenue, where attackers allegedly obtained spending permissions before transferring funds from affected wallets.

The security firm said the approval and transfer occurred within the same transaction, allowing the attackers to move funds immediately after obtaining authorization.

Salus observed that the stolen funds were divided between two addresses in a pattern resembling an established wallet drainer service model, although it did not confirm that the same infrastructure was involved.

Wallet drainers can exploit permissions granted through ordinary blockchain transactions, including token approvals and signed messages.

A July 2026 analysis of wallet drainers explained how malicious websites can disguise dangerous spending permissions as routine NFT minting, token claims or account verification requests.

To make matters worse, some approvals remain active until the wallet owner revokes them, potentially allowing an authorized contract to transfer assets after the original interaction.

How can users verify legitimate QQL Mint Passes?

QQL’s documentation provides a contract address for collectors who want to verify legitimate Mint Passes on Ethereum.

The official Mint Pass guide identifies the contract as 0xc73B17179Bf0C59cD5860Bb25247D1D1092c1088.

Users can verify the legitimacy of a QQL Mint Pass by checking its contract address against the collection’s listing on Etherscan.

According to the project’s documentation, buyers can obtain passes through secondary markets, but they should verify the collection contract before purchasing.

The documentation distinguishes purchasing a Mint Pass from using one to create an official QQL NFT.

A collector must hold a valid pass before minting an artwork, and the pass is destroyed when the mint is completed.

While explaining QQL in a previous blogpost, Hobbs has confirmed that the project allows holders to select which generated artworks become permanent NFTs in the collection.

He said the minting process has been designed to continue over an extended period, with collectors able to use their passes whenever they selected artwork for inclusion.