#User lost $460,000 in a simulated trading scam.#
Hot Topic Overview
Overview
Recently, a user lost 143.45 ETH, approximately $460,800, due to a transaction simulation scam. The attacker exploited the delay between the transaction simulation feature in the Web3 wallet and the actual execution. They used a phishing website to tamper with the on-chain state immediately after the user submitted the transaction. This led the user to believe they would receive 0.000…0001 ETH after signing the transaction, but they actually lost 143.45 ETH. This incident serves as a reminder for users to be cautious when using the transaction simulation feature in Web3 wallets and to be vigilant in identifying phishing websites to avoid similar losses.
Ace Hot Topic Analysis
Analysis
Recently, a user lost 143.45 ETH, approximately $460,800, due to a transaction simulation scam. The attacker exploited the delay between the transaction simulation feature in Web3 wallets and actual execution. They created a phishing website and immediately tampered with the on-chain state after the user submitted the transaction, deceiving the user. The attacker modified the contract state, making the transaction simulation appear as if the user would receive a small amount of ETH, while the actual executed transaction transferred the user's funds to the attacker's account. This attack method, known as "transaction simulation scam," is a new threat in the Web3 security landscape. It serves as a reminder for users to exercise caution when conducting transactions, avoid trusting unverified websites or information, and carefully review the transaction details.
Public Sentiment · Discussion Word Cloud
Public Sentiment
Discussion Word Cloud
Classic Views
The transaction simulation function was exploited by attackers to manipulate the on-chain state through phishing websites, resulting in user fund losses.
Attackers exploited the delay between transaction simulation and execution to modify the contract state before user signature, deceiving users into believing that the transaction result met expectations.
Attackers forged transaction simulation results to induce users to sign malicious transactions, resulting in user fund losses.
The transaction simulation function has security vulnerabilities, and developers and users need to be vigilant to prevent similar incidents from happening again.