If you ever see an ENS NFT named your-name-here.eth.loan hit your wallet and then somehow leave all on its own, don’t worry, it doesn’t mean you were hacked. It’s a unique feature in ENS that allows the parent of wrapped subdomains to control where the subdomain is sent to. That means anyone can send that kind of NFT to your wallet with the click of a button and then send it to someone else’s wallet from yours with another click. Here’s an example of how that would look on etherscan:
The ENS names in between did not initiate the “transfers” shown on etherscan. Rather the parent of that (yours truly) just kept replacing the name in the ENS app that I wanted it to be sent to. Etherscan displayed those actions as such. SOOOO if you receive a wrapped ENS subdomain and then get notified that you sent it somewhere else, don’t fret, it’s just the parent moving it around. Weird, I know, but that’s how it works. The more we understand the better.