Yuga Labs blockchain executive Quit urged collectors not to engage with accounts claiming to offer a new QQL mint. He reported one wallet loss but did not disclose the amount or transaction records.
QQL collectors have been warned about mint announcements from accounts impersonating artist Tyler Hobbs. Quit, vice president of blockchain at Yuga Labs, said in an October 19 post on X that several impersonator accounts were claiming QQL minting had reopened. He urged collectors not to interact with them.
Quit said one person had lost assets from a wallet, while another avoided a similar loss with the Pocket Universe security tool. The post did not disclose victim addresses, transaction hashes or the amount lost. It also did not identify the requested transaction or signature, leaving the attack’s technical method unverified.
“QQL minting has not reopened.”
Quit on X
Quit’s warning about impersonator accounts was published on October 19 UTC:
Existing Mint Pass holders can still create artworks
Existing Mint Pass holders do not need a new sale to mint their chosen artwork. QQL’s official documentation says the collection began with 999 passes in September 2022 and that the passes do not expire. Each grants the right to turn one selected output from the algorithm into an official QQL NFT. The pass is burned when the artwork is minted, reducing the remaining supply of unused passes as the collection grows.
In QQL, created by Tyler Hobbs and Dandelion Mané, collectors do not simply have to accept a random image generated at purchase. They can explore outputs and decide which artwork enters the permanent collection. The project’s overview and FAQ says anyone can experiment with the algorithm and view images, while a Mint Pass is required to mint an official NFT. Hobbs also explains that users can optionally connect an Ethereum wallet to save the images they generate.
In a May 3, 2024 explanation, Hobbs describes how a piece of data called a seed allows the same image to be reproduced. The creator’s wallet address forms part of the seed, and the seed’s owner has the right to mint the work into the official collection by default. Seed ownership can be transferred. On the Seed Marketplace, introduced in 2023, purchasing a listed output requires minting it as an official QQL NFT at the same time.
The 00:19–00:57 section of the earlier Vimeo introduction embedded on QQL’s site explains the 999 passes and the collector’s role in choosing an artwork. The recording is published under Tyler Hobbs’s account and its description promotes the original September 28, 2022 auction. It is historical project context, not a video about the current impersonation warning. The description said 900 of the 999 passes would be offered at that auction.
Checking the contract behind a Mint Pass
QQL’s Mint Pass guide separately warns that counterfeit pass collections exist. It directs collectors to official links for the secondary-market collection and recommends comparing the contract address shown on OpenSea through Etherscan. The address identifies the Mint Pass contract, which carries the right to mint; it should not be confused with the collection of completed QQL artworks.
Official Mint Pass contract: 0xc73B17179Bf0C59cD5860Bb25247D1D1092c1088. QQL publishes the address in its own guide. A copied name or image is insufficient to identify the genuine collection. The website’s domain and requested wallet permission still require separate checks.
No technical finding was provided showing that Hobbs’s real account had been compromised or that the QQL contract contained an exploit. Attacker addresses and whether there are further victims remain unknown.
An earlier FBI warning describes developer impersonation
In an August 4, 2023 NFT fraud advisory, the FBI described criminals taking over developers’ social media accounts or creating near-identical profiles. Surprise releases and limited-supply claims can pressure collectors to act quickly, while links lead to counterfeit project websites. In the scenarios described by the agency, malicious contracts transfer assets from victims’ wallets to attackers. The advisory explains a general phishing method; it does not establish which permission, if any, was obtained in the QQL case.
The agency recommends checking the announcing account’s history and username, as well as the website’s domain. It asks people reporting suspected fraud to retain the links, social media accounts, crypto addresses and domains used.
