Security

Last updated: 25 October 2026.

The short version: Unlisted can never move your NFTs. We never ask for your seed phrase, never ask you to approve spending, and you can use us without connecting a wallet at all.

What we can and can't do

• We cannot move your NFTs or tokens. Signing in is a plain text message that only proves you own a wallet. It is not a transaction, costs no gas, and gives us no permission over anything.
• We never ask for approvals. We will never ask you to "set approval for all", approve a token, sign a permit, or sign anything that is not a readable sign-in message. If a page claiming to be Unlisted asks for any of these, close it.
• We never ask for your seed phrase or private key. No one at Unlisted will ever message you asking for them.
• We hold no keys and no funds. We don't store anything that could move your assets.
• Payments are small and checked. The only transaction we ever ask you to send is a plain payment for a paid frame, capped at $50. Your wallet shows the exact amount and recipient before you confirm, and our page refuses to send it if the amount or recipient doesn't match what we published.

No wallet connection needed

If you would rather not connect a wallet, choose Verify with OpenSea. You put a one-time code in your OpenSea bio to prove the profile is yours. The code works once, only for your wallet and your browser, and expires in 10 minutes. You can delete it from your bio straight after. Paying for a frame is the only time a wallet connection is needed.

Protect yourself

• Check the address. Our only address is unlistedgallery.com. Bookmark it. Fake lookalike sites are the most common way people lose NFTs.
• We never DM first with a link to connect or claim something. Anyone who does is not us. Our only account is @unlistedgallery.
• Read every wallet prompt. A sign-in request here is plain text starting "unlistedgallery.com wants you to sign in". Reject anything that asks to approve spending or looks like unreadable code.
• Keep valuables in a separate wallet. A common approach is a cold wallet for your best pieces and a separate wallet for connecting to sites. A gallery only shows what you choose to hang.
• Use a wallet security extension that previews transactions and warns about risky sites, and keep your wallet app updated.
• Review old approvals now and then with a tool such as Revoke.cash, and remove any you don't recognise.

What's public

A gallery shows only the NFTs you choose, with your username. We never show your wallet address on your page. Keep in mind that NFT ownership is public on the blockchain, so anyone can look up who owns a particular NFT. If that matters to you, display pieces held in a wallet that doesn't hold your most valuable assets.

How the site is protected

• Sessions use secure cookies that page scripts cannot read.
• A strict content policy blocks outside scripts, and the site cannot be embedded in other sites.
• Sign-ins use one-time random codes, so a captured sign-in can't be replayed.
• Sign-in and verification attempts are rate-limited.
• Admin tools are separate from everyday sign-in. OpenSea-verified sessions can't reach them.

Report a problem

If you find a security issue, or something that looks like a fake Unlisted site or account, message @unlistedgallery on X.