#User lost $460,000 in a simulated trading scam.#
Hot Topic Overview
Overview
Recently, a user lost 143.45 ETH, approximately $460,800, due to a transaction simulation scam. The attacker exploited the delay between transaction simulation and execution in Web3 wallets by creating a phishing website and manipulating the on-chain state immediately after the user submitted the transaction. Specifically, the attacker initiated a fake "Claim" ETH transfer request, and the wallet simulated receiving a small amount of ETH. However, the attacker subsequently modified the contract state, resulting in the user's actual transaction depleting their wallet assets. This incident serves as a reminder for users to exercise caution when using the transaction simulation feature in Web3 wallets and to be vigilant in identifying phishing websites to avoid similar fraudulent losses.
Ace Hot Topic Analysis
Analysis
Recently, a user lost 143.45 ETH, approximately $460,800, due to a transaction simulation scam. The attacker exploited the delay between transaction simulation and execution in Web3 wallets by creating a phishing website and manipulating the on-chain state immediately after the user submitted the transaction. Specifically, the attacker would initiate a "Claim" ETH transfer request, and the wallet would simulate receiving a small amount of ETH. However, the attacker would then modify the contract state, resulting in the actual transaction draining the user's wallet assets. This incident serves as a reminder for users to exercise extreme caution when conducting Web3 transactions, avoid trusting phishing websites, and carefully verify transaction information to prevent losses from transaction simulation scams.
Public Sentiment · Discussion Word Cloud
Public Sentiment
Discussion Word Cloud
Classic Views
Web3 wallet's transaction simulation function has a security vulnerability, attackers can exploit the delay to tamper with the on-chain state.
Attackers create phishing websites to lure users into transaction simulation, and immediately modify the contract state after the transaction is submitted, resulting in user asset loss.
The transaction simulation function is designed to improve transparency and user experience, but attackers exploit the vulnerability of this function, causing user losses.
Users should be cautious about identifying phishing websites and be aware of the delay risk between transaction simulation and execution when performing transaction simulation.