#User lost $460,000 in a simulated trading scam.#
Hot Topic Overview
Overview
Recently, a user lost 143.45 ETH, worth approximately $460,800, due to a transaction simulation scam. The attacker exploited the delay between transaction simulation and execution in Web3 wallets by creating a phishing website that manipulated the on-chain state immediately after the transaction was submitted. The attack process involved the phishing website initiating a "Claim" ETH transfer request. The wallet simulated receiving a small amount of ETH, but the backend modified the contract state, ultimately leading to the user's wallet assets being depleted. This incident serves as a reminder for users to carefully identify phishing websites and be aware of the difference between transaction simulation and actual execution when conducting Web3 transactions, to avoid similar losses.
Ace Hot Topic Analysis
Analysis
Recently, a user lost 143.45 ETH (approximately $460,800) due to a transaction simulation scam, raising concerns about the security of Web3 wallets. The attacker exploited the delay between transaction simulation and execution by creating a phishing website and manipulating the on-chain state immediately after the user submitted the transaction. Specifically, the attacker initiated a "Claim" ETH transfer request, and the wallet simulated receiving a small amount of ETH. However, the attacker subsequently modified the contract state, resulting in the user's actual transaction draining their wallet assets. This incident serves as a reminder that even security features like transaction simulation can be exploited by attackers. Users need to exercise extreme caution when conducting Web3 transactions, avoid visiting suspicious websites, and carefully review transaction details, ensuring the correct target address and amount.