setApprovalForAll hands one address control of every NFT you own in a collection, including ones you have not bought yet.
setApprovalForAll is the single most costly signature in NFTs, because it does not apply to one token. It applies to the whole collection, and it keeps applying to any token from that collection you acquire in future.
Real marketplaces need it. Listing an NFT for sale means the marketplace must be able to transfer it the moment someone buys, without waking you up to sign again. That is a legitimate use, and it is why the request looks familiar and unalarming.
The problem is that the request from a scam site is byte-for-byte the same shape. Nothing in the payload distinguishes a marketplace from a thief. The only difference is the operator address — and that is a 42-character hex string most people do not check.
Once granted, the operator can move every matching NFT out of your wallet at a time of their choosing. There is no second confirmation. Many victims grant approval and are drained days later, after they have forgotten the interaction.
The value that matters is the second argument. `true` grants control. `false` revokes it. A transaction that sets it to false is a good thing — that is what a revocation looks like.
See this decodedOpens the decoder with this exact payload loaded.