What Is an NFT, Practically

A non-fungible token is an entry in a contract saying that a particular address owns a particular identifier. That is the whole technical substance.

What the token contains

Usually a number and a link.

The image, video or file is generally not stored on the chain, because storing data on-chain is prohibitively expensive. The token points to it, typically through a link to a distributed storage network or an ordinary web server.

If that server goes away, the link breaks. The token still exists and points at nothing.

What ownership gives you

A record that your address holds the identifier. Verifiable by anyone.

The ability to transfer it.

Whatever the issuer has chosen to attach. Access to something, a claim on something, membership. All of that comes from the issuer’s promises, not from the token itself.

What it does not give you

Copyright, unless the issuer explicitly grants it in terms you can read. Most do not.

Exclusive use of the image. Anyone can copy the file. The token records ownership of the entry, not of the content.

Any guarantee the linked content persists.

The practical risks

Marketplace approvals. Listing an item for sale grants a marketplace permission over your collection, frequently collection-wide. That permission is what gets exploited in the most common attacks in this category.

Signature-based listings. Most marketplaces use signed orders rather than transactions. A malicious site can present a signature request that looks like a listing and is actually an order selling your item for nothing.

Liquidity. Most items cannot be sold at any price. A floor price on a marketplace describes the lowest listing, not what anyone will pay.

The safety rules

Use a separate wallet for anything you connect to a marketplace, holding only what you are trading.

Revoke marketplace approvals when not actively selling. Block explorer tools list them.

Read signature requests. If your wallet cannot decode one into a readable listing with a price, do not sign it.

Treat unsolicited offers as hostile. Messages offering to buy a valuable item are the standard delivery mechanism for a malicious signature request.

The honest summary for a beginner

Buying one is buying a record plus whatever the issuer promises, in a market where most items are illiquid and the most common way to lose money is signing something you did not read.

If that sounds discouraging, it is meant to be proportionate rather than dismissive. Some of this has genuine uses. None of them requires you to participate before understanding how the approvals work.

The rest of your holdings, and particularly the working balance at a platform that lets you withdraw to your own wallet, should be in a wallet that has never connected to a marketplace at all.