{"id":11440,"date":"2026-08-03T17:43:06","date_gmt":"2026-08-03T17:43:06","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=11440"},"modified":"2026-08-03T17:43:06","modified_gmt":"2026-08-03T17:43:06","slug":"researchers-just-uncovered-4200-malicious-smart-contracts-that-successfully-tricked-5700-victims-into-signing-away-their-crypto","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=11440","title":{"rendered":"Researchers just uncovered 4,200 malicious smart contracts that successfully tricked 5,700 victims into signing away their crypto"},"content":{"rendered":"

<\/p>\n

\n

Simulating transfers using safety tools inside crypto wallets can show a small gain even when the final transaction sends the user’s deposit to an attacker, according to a July 30 arXiv preprint that links the technique to 5,742 victim addresses and about $3.48 million in historical losses.<\/p>\n

The authors used SimGuard, a contract-bytecode detector, to identify 4,224 transaction-simulation phishing contracts across Ethereum, BNB Smart Chain, Avalanche and Polygon.<\/p>\n

The study associated them with 6,223 victim transactions but called the loss estimate an upper bound because some attacker test activity may have been misclassified. It attributed 91.5% of the losses to Ethereum and about 83% of the cross-chain total to its largest inferred cluster.<\/p>\n

\n
\"$538M\"$538M<\/div>\n
Related Reading<\/span><\/p>\n

$538M stolen by drainers: ETH & SOL wallets unite with real-time phishing blocks<\/h3>\n

Inside MetaMask\/Phantom\u2019s new intel network and how we\u2019ll measure success.<\/p>\n

Oct 23, 2025<\/span> \u00b7<\/span> Gino Matos<\/span><\/p>\n<\/div><\/div>\n

The findings have not been peer reviewed. The paper also gives inconsistent figures for its Avalanche contract count and conflicting endpoints for the observation period, leaving its per-chain breakdown and exact time window unresolved.<\/p>\n

How a safe-looking preview can diverge<\/h2>\n

Transaction simulation takes a pre-signing snapshot of what a transaction is expected to do. The contracts described in the paper contain branches that can produce one result during that check and another when the transaction executes on-chain.<\/p>\n

\"Infographic\"Infographic<\/p>\n

In a storage-control example, the simulation returns the user’s deposit plus a tiny reward. An attacker can then change the contract’s state, such as by blacklisting the user’s address, before the transaction lands. The executed branch sends the deposit to an attacker-controlled address instead.<\/p>\n

Timestamp-based contracts can exploit the later block time, while gas-control contracts can behave differently when the simulator and final transaction use different gas limits. Not every variant therefore requires an attacker to alter stored on-chain data after the preview.<\/p>\n

In a controlled test, the authors sent an account’s balance to a contract that returned as little as 1 wei, the smallest unit of ETH. They reported that several tested previews displayed a positive estimate and most did not clearly show the full outgoing amount.<\/p>\n

\n
\n
CryptoSlate Daily Brief<\/span><\/p>\n

Daily signals, zero noise.<\/h3>\n

Market-moving headlines and context delivered every morning in one tight read.<\/p>\n

5-minute digest<\/span> 100k+ readers<\/span><\/p>\n<\/div>\n

\n

Free. No spam. Unsubscribe any time.<\/p>\n

Whoops, looks like there was a problem. Please try again.<\/span><\/p>\n

You\u2019re subscribed. Welcome aboard.<\/span><\/p>\n<\/div>\n<\/div>\n<\/div>\n

The paper does not identify the wallet versions, settings, or simulation backends used by the historical victims. MetaMask’s current documentation calls estimated balance changes predictions and warns that the final outcome is not guaranteed.<\/p>\n

\n
\"MetaMask\"MetaMask<\/div>\n
Related Reading<\/span><\/p>\n

MetaMask opens AI wallet for DeFi agents as security risks shift to user rules<\/h3>\n

Agent Wallet lets software trade onchain, making user-set limits the new line between automation and loss.<\/p>\n

Jun 10, 2026<\/span> \u00b7<\/span> Liam ‘Akiba’ Wright<\/span><\/p>\n<\/div><\/div>\n

A Jan. 8, 2025 Etherscan transaction cited by the study records a Claim() call moving about 143.45 ETH through a contract Etherscan labels as phishing. The on-chain record supports the transfer described in the paper, although it cannot show what appeared in the user’s wallet preview.<\/p>\n

The authors recommend re-running simulations when relevant contract state or gas fields change, using the gas limit and gas price in the actual request, and testing current and future block-number and timestamp inputs. Their UI findings also support showing the gross amount leaving a wallet alongside an accurate net balance change, so a negligible refund cannot be mistaken for a profit.<\/p>\n

\n
\"Hundreds\"Hundreds<\/div>\n
Related Reading<\/span><\/p>\n

Hundreds of MetaMask wallets drained: What to check before you \u2018update’<\/h3>\n

ZachXBT tracked $107,000 drained from hundreds of wallets through fake MetaMask emails. Here’s how to spot phishing, revoke approvals, and segregate holdings before attackers strike.<\/p>\n

Jan 3, 2026<\/span> \u00b7<\/span> Gino Matos<\/span><\/p>\n<\/div><\/div>\n

The preprint describes historical activity, not a live July or August attack wave. Its detector evaluation covered 44 contracts, including 30 generated with Gemini, and the linked code-and-data repository returned HTTP 401 when checked.<\/p>\n

The aggregate results therefore remain the authors’ findings rather than an independently reproduced measurement.<\/p>\n<\/div>\n

Featured,Research,Scams,Wallets,BNB,Coinbase Wallet,ethereum,MetaMask,Trust WalletBNB,Coinbase Wallet,ethereum,MetaMask,Trust Wallet#Researchers #uncovered #malicious #smart #contracts #successfully #tricked #victims #signing #crypto1785778986<\/p>\n","protected":false},"excerpt":{"rendered":"

Simulating transfers using safety tools inside crypto wallets can show a small gain even when the final transaction sends the user’s deposit to an attacker, according to a July 30 arXiv preprint that links the technique to 5,742 victim addresses and about $3.48 million in historical losses. The authors used SimGuard, a contract-bytecode detector, to<\/p>\n","protected":false},"author":1,"featured_media":11441,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[2261,5984,1579,62,31,5987,4878,3149,4468,1722,5988,5989,5985,5986,4371],"class_list":["post-11440","post","type-post","status-publish","format-standard","has-post-thumbnail","category-ethereum","tag-bnb","tag-coinbase-wallet","tag-contracts","tag-crypto","tag-ethereum","tag-malicious","tag-metamask","tag-researchers","tag-signing","tag-smart","tag-successfully","tag-tricked","tag-trust-wallet","tag-uncovered","tag-victims"],"yoast_head":"\nResearchers just uncovered 4,200 malicious smart contracts that successfully tricked 5,700 victims into signing away their crypto - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"description\" content=\"A preprint links transaction simulation phishing to 5,742 victims and up to $3.48 million in losses across four EVM chains.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=11440\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Researchers just uncovered 4,200 malicious smart contracts that successfully tricked 5,700 victims into signing away their crypto\" \/>\n<meta property=\"og:description\" content=\"A preprint links transaction simulation phishing to 5,742 victims and up to $3.48 million in losses across four EVM chains.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=11440\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-03T17:43:06+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/wallet-transaction-preview-phishing-attack.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11440\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=11440\",\"name\":\"Researchers just uncovered 4,200 malicious smart contracts that successfully tricked 5,700 victims into signing away their crypto - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11440#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11440#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/wallet-transaction-preview-phishing-attack.jpg\",\"datePublished\":\"2026-08-03T17:43:06+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"description\":\"A preprint links transaction simulation phishing to 5,742 victims and up to $3.48 million in losses across four EVM chains.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11440#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=11440\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11440#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/wallet-transaction-preview-phishing-attack.jpg\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/wallet-transaction-preview-phishing-attack.jpg\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=11440#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Researchers just uncovered 4,200 malicious smart contracts that successfully tricked 5,700 victims into signing away their crypto\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto & Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Researchers just uncovered 4,200 malicious smart contracts that successfully tricked 5,700 victims into signing away their crypto - Crypto News: Latest Cryptocurrency News and Analysis","description":"A preprint links transaction simulation phishing to 5,742 victims and up to $3.48 million in losses across four EVM chains.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=11440","og_locale":"en_US","og_type":"article","og_title":"Researchers just uncovered 4,200 malicious smart contracts that successfully tricked 5,700 victims into signing away their crypto","og_description":"A preprint links transaction simulation phishing to 5,742 victims and up to $3.48 million in losses across four EVM chains.","og_url":"https:\/\/cryptonews.uk.com\/?p=11440","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-08-03T17:43:06+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/wallet-transaction-preview-phishing-attack.jpg","type":"image\/jpeg"}],"author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=11440","url":"https:\/\/cryptonews.uk.com\/?p=11440","name":"Researchers just uncovered 4,200 malicious smart contracts that successfully tricked 5,700 victims into signing away their crypto - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=11440#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=11440#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/wallet-transaction-preview-phishing-attack.jpg","datePublished":"2026-08-03T17:43:06+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"description":"A preprint links transaction simulation phishing to 5,742 victims and up to $3.48 million in losses across four EVM chains.","breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=11440#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=11440"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=11440#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/wallet-transaction-preview-phishing-attack.jpg","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/08\/wallet-transaction-preview-phishing-attack.jpg","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=11440#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"Researchers just uncovered 4,200 malicious smart contracts that successfully tricked 5,700 victims into signing away their crypto"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto & Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/11440","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=11440"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/11440\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/11441"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11440"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11440"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11440"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}