How NFTs Record Ownership on a Chain

An NFT (non-fungible token) is a ledger entry: on Ethereum-style chains, a token contract keeps a record that says which address owns which token ID. The picture, audio or file the token is associated with is usually stored somewhere else, and the token does not by itself carry the copyright to it.

Key takeaways

Under the ERC-721 standard, a specific NFT is identified by the pair of a contract address and a token ID, and the contract's ownerOf function returns the owner's address.
ERC-1155 contracts record balances per account and token ID instead of a single owner per token, so one contract can hold both unique and multiple-copy items.
Most works tied to NFTs are stored off-chain; the token holds a pointer, and a centralized link can break or change while a content-addressed IPFS link depends on someone still storing the file.
A joint US Patent and Trademark Office and Copyright Office report says ownership of an NFT and ownership of copyright in the associated work are separate, so a separate agreement is ordinarily needed to transfer any copyright.
Royalties under the ERC-2981 standard are voluntary unless the collection's contract adds its own enforcement. For a token in your own wallet, whoever controls the private key, or holds an approval, can move it.

What the chain actually records

The ERC-721 standard (status Final, created January 2018) defines the common interface for NFTs. Each token has a uint256 ID that is unique inside its contract and does not change for the life of that contract. The standard calls the pair of contract address and token ID a globally unique, fully qualified identifier for a specific asset on an Ethereum chain.

The contract's ownerOf function returns the address that owns a given token. Tokens assigned to the zero address are treated as invalid, and queries about them throw an error. That is the whole ownership claim on-chain: an address, not a name, and not a legal title.

Transfer events form the history

ERC-721 also requires a Transfer event whenever ownership of any NFT changes by any mechanism. Creation (minting) is logged as a transfer from the zero address, and destruction (burning) as a transfer to the zero address. One exception: during contract creation, a contract may create and assign any number of NFTs without emitting Transfer, so the event log alone is not always a complete mint history.

ERC-1155 tracks balances, not single owners

The ERC-1155 standard (status Final, created June 2018) lets one contract manage many token types. Its balanceOf function returns how many units of a token ID an account holds, and its TransferSingle and TransferBatch events log movements. A unique item can be modeled by capping a token ID at a quantity of one, while other IDs can have many units. The standard says balances must be derivable from the events alone.

A simulated ledger, step by step

Real contracts store Ethereum addresses of 20 bytes. The sketch below uses short names so the structure is easy to read. It is a simplified simulation written for this explanation, not code from any real contract. Run in Python 3, it mints token IDs 1 to 3 and then transfers token 2.

owners = {}
log = []

def mint(token_id, to):
    owners[token_id] = to
    log.append(("Transfer", "zero address", to, token_id))

def transfer(token_id, sender, to):
    assert owners[token_id] == sender   # only the current owner's record can move
    owners[token_id] = to
    log.append(("Transfer", sender, to, token_id))

mint(1, "Ana"); mint(2, "Ben"); mint(3, "Cy")
# print(owners, log)  -> state "before"
transfer(2, "Ben", "Dee")
# print(owners, log)  -> state "after"

Output of that script, as run:

Step	Owner map (token ID: owner)	Event log entries
Before the transfer	1: Ana, 2: Ben, 3: Cy	3 events: Transfer from zero address to Ana (ID 1), to Ben (ID 2), to Cy (ID 3)
After transferring token 2	1: Ana, 2: Dee, 3: Cy	4 events: the same 3 mints, plus Transfer from Ben to Dee (ID 2)

Two points follow from the numbers. Only one row of the owner map changed, so tokens 1 and 3 were untouched. The log grew by exactly one entry and kept every earlier one, which is why the owner map shows the present and the log shows how it got there.

The sketch lets only the current owner move a token. Under ERC-721, a transfer can also be started by the address approved for that token or by an operator the owner has authorized, which is covered in the approvals section below.

Where the image and metadata live

ERC-721 offers an optional metadata extension. Its tokenURI function returns a distinct URI for an asset, and the URI may point to a JSON file with fields such as name, description and image. The standard states plainly that the URI may be mutable, meaning it can change from time to time. In the standard's metadata schema, the image field is itself a separate URI, so the metadata file and the picture can sit in different places.

The joint USPTO and Copyright Office report notes that an asset associated with an NFT can be stored on-chain or off-chain, and that the vast majority are stored off-chain, with the ledger entry pointing to the work or to a URI saying where it is. Off-chain locations include a centralized system such as a URL, or a decentralized one such as IPFS.

Centralized links versus content addressing

A web URL names a place. If the server owner moves or deletes the file, the token still exists but points at nothing, or at something different. IPFS names the content instead: a content identifier (CID) is built from the content's cryptographic hash, and any difference in the content produces a different CID. A changed file therefore cannot silently sit behind the same CID.

That protects integrity, not availability. IPFS's own persistence documentation says it does not guarantee that content stays available; content remains reachable if it is pinned (kept on purpose by a node or pinning service) or stored long term, and the page warns that third-party pinning providers may stop operating.

What the token does not convey

The joint report, Non-Fungible Tokens and Intellectual Property, was delivered to Congress on March 12, 2024. On transfers, it states:

"ownership of an NFT and ownership of any copyright interests in the associated work are separate."

It adds that some marketplaces may suggest a purchase signifies ownership of or a license to a work, but nothing about the token necessarily entails exclusivity over anything but the token itself. Transferring an NFT does not itself imply or grant a license, and a separate agreement is ordinarily needed to transfer any copyright or other associated rights. Whether copying or displaying the work infringes depends on the facts and the license terms, so the report does not give a universal answer.

Ethereum.org's NFT overview describes the benefit as publicly verifiable ownership of a token on-chain, and does not address copyright.

Tax and legal status in one place

For tax, IRS Notice 2023-27 describes how the IRS intends to decide whether an NFT is a collectible under section 408(m) of the Internal Revenue Code, pending further guidance. Under its "look-through analysis," an NFT is a collectible if the right or asset it is associated with is one. An NFT certifying ownership of a gem would be a collectible, while one giving a right to use a "plot of land" in a virtual environment generally would not. For an NFT tied to a digital art file, the notice leaves the answer open: Treasury and the IRS say they are still considering whether a digital file can be a "work of art" under the statute.

Collectible status matters because a collectible that is a capital asset held more than one year faces a maximum 28% long-term capital gains rate, while other assets generally face a lower maximum. The IRS digital assets page, last updated September 2, 2026, still lists Notice 2023-27 as its guidance on NFTs as collectibles. Because the notice only announces intended guidance, confirm the current position with a tax professional before filing.

On securities law, the SEC and CFTC interpretation published at 91 FR 13714 (March 23, 2026) defines a digital collectible as a crypto asset designed to be collected and/or used, and says such an asset is not itself a security. It says a creator royalty does not change a digital collectible into a security. Two conditions apply: a non-security crypto asset can still be offered and sold subject to an investment contract, which is a security, and a fractionalized collectible could constitute the offer or sale of a security.

Royalties: signal or enforced

The ERC-2981 standard (status Final, created September 2020) adds a royaltyInfo function. Given a token ID and a sale price, it returns a receiver address and a royalty amount. The standard says royalty payment must be voluntary, and that if a marketplace chooses not to implement it, no funds will be paid for secondary sales. Under ERC-2981 alone, then, the contract states a preference and the sale venue decides whether to honor it.

Some collections go further and enforce the fee in their own contract code. OpenSea's developer documentation on creator fee enforcement (updated August 17, 2026) describes this for tokens built on the ERC721-C and ERC1155-C contract standards: a transfer validator checks that the creator fee is included in the order, and the transfer reverts if it is not.

OpenSea's fees help page (dated May 12, 2026) says creator earnings on its platform are either enforced or optional. If enforced, the collection's set percentage is paid at the time of sale. If optional, the seller chooses whether to pay the creator's suggested amount. The same page says OpenSea typically charges a 1% fee for selling NFTs and that fees are set when a listing or offer is created.

Illustrative example: one hypothetical sale

This sale is invented for the arithmetic. Assume a sale price of $1,000, a 5% creator royalty and a 2.5% marketplace fee (not any real venue's rate), with gas fees ignored.

seller proceeds = price - (price x royalty rate) - (price x marketplace fee rate)
                = 1,000 - (1,000 x 0.05) - (1,000 x 0.025)
                = 1,000 - 50.00 - 25.00
                = 925.00

With the royalty paid, the seller receives $925.00, the creator $50.00 and the marketplace $25.00. If the same sale happened on a venue where the royalty is optional and the seller skips it, proceeds would be $975.00 (1,000 - 25.00), a $50.00 difference. For a plain ERC-2981 token, nothing in the contract differs between the two cases; only the venue's rules do. On OpenSea, the $975.00 outcome is not available for a collection with enforced creator earnings, because the set percentage is paid at the time of sale.

Approvals, keys and drainers

For a token held in your own wallet, on-chain ownership means control of a key. Ethereum.org's security guidance says that anyone with your recovery phrase or private keys can access your accounts and drain every asset, and that a transaction sent on Ethereum is irreversible. If a platform holds the token for you, ownerOf returns the platform's address, not yours. The contract's own code can also keep powers for its deployer or an admin address, such as changing a mutable token URI.

Approvals add a second route. In ERC-721, approve lets one address move one token, while setApprovalForAll enables an operator to manage all of the caller's NFTs in that contract. ERC-1155's version applies to the entire token set, not individual IDs. These are legitimate features that marketplaces use, but a broad approval given to a malicious contract lets it move every token covered.

The FBI's Internet Crime Complaint Center alert of August 4, 2023 describes victims connecting wallets on spoofed NFT sites to a drainer smart contract, which transfers cryptocurrency and NFTs to criminal wallets. Its advice includes checking announcements and social accounts for clones, looking for misspelled domains, and being skeptical of NFT rewards that seem too good to be true.

Frequently asked questions

What happens to an NFT sent to the zero address?

ERC-721 treats NFTs assigned to the zero address as invalid, and queries about them throw. A transfer to the zero address is also how the standard describes destroying (burning) a token. The token ID then no longer has a valid owner.

Can the metadata behind a token change after minting?

It can, depending on the contract. ERC-721 says the URI may be mutable, and an off-chain file at a changeable location can be replaced by whoever controls it. A content identifier on IPFS changes if the content changes, so a swap would show up as a different identifier. If the URI is mutable, though, the contract can be pointed at that new identifier.

Does a royalty make an NFT a security?

According to the SEC and CFTC interpretation at 91 FR 13714, a creator royalty does not change a digital collectible into a security. The same document says fractionalizing a collectible could constitute an offer or sale of a security, and that a non-security asset can still be sold subject to an investment contract. Whether a particular token qualifies depends on its facts, including what its issuer promises buyers.

Can an IRA hold an NFT that counts as a collectible?

Notice 2023-27 recites section 408(m)(1), under which an IRA's acquisition of a collectible is treated as a distribution equal to its cost. Whether a given NFT is a collectible turns on the look-through analysis of its associated right or asset. The notice also flags possible prohibited-transaction issues in some cases.

Where can a wallet-drainer incident be reported?

The FBI's alert asks victims to file a complaint at ic3.gov, using the keyword "NFTHack" and including links, social media accounts, crypto accounts or domains involved. This is a reporting channel only; the alert does not promise recovery of assets.

Checks before you rely on a record

Find the contract address and token ID, then check ownership in a block explorer rather than a marketplace page alone. For ERC-721, ownerOf returns the owner. For ERC-1155, balanceOf shows how many units a given address holds. If a platform holds the token for you, expect to see its address.
Open the tokenURI and note whether it starts with a web address or an IPFS identifier. Do the same for the image link inside the metadata file, since the two can differ, and note who controls the storage.
Read any license terms separately; the token itself does not state them.
Check whether the venue, or the collection's contract, enforces creator royalties before assuming a sale will or won't pay one.
Review active approvals on the wallet and never share a recovery phrase.