Address Poisoning Attack

I — New Scam Going On TRX/USDT/BSC/ETH/Polygon Users!

This malicious contract involved:

  • 0x732e9b5f59c9a442db18f7d57dd2bbfc804281cb

  • Decompiled

Basically the attacker creates a vanity address very similar to your own, and send you very small amounts of USDT or something in the hope that you’ll check balance on BlockScan, and one day copy and paste their address and send to it by mistake!

The next time Victim A carelessly copies the address of the historical transaction, it is easy to copy it to the address C prepared by the hacker by mistake, thus transferring the funds to the wrong account.

Check Out:

Sleepy people sometimes do illogical things 🤷‍♂️ one of the chat users got attacked for 10k$:

  • a8ae672bb0e6afaf3cd34b4d33de82d65714682d1c64c6ea1e03313bc5ad529b

While seemingly simple and similar to the Dusting Attack, this is a completely new thing closer to social engineering/vanity attacks/phishing!

TLDR: always double-check any address letter by letter, digit by digit! Whitelist your working addresses!

II — Attack Variations

Questions began to be raised over the discovery of mysterious outgoing zero transactions with supposed approve signatures…

Check out this example, seen both at Tron and Ethereum Main-net:

This address (Attacker):

Is interacting with this smart contract (and other similar ones):

Creating transactions like these:

Another example (Tron):

At the same time, all of the customers reported that no one had signed such approves! In a nutshell, it’s the identical spam attack as in the previous example!

The transferFrom function was called, not transfer, which means that the From address was supposed to give that address who signed the transaction, but since the sum is zero and all new contract memory cells are initialized with zeros, everything runs smoothly (since there is a 0 for any address) ( 🤔

TLDR: You must just ignore these transactions!

Here, an attacker is sending 0 transactions in hope someone will copy last receiver address and send crypto by mistake - like in a clipboard (clipper malware) attack!

Unlike the first attack the attackers may also first wait for you to ask about strange transactions somewhere on Twitter and then finish scam with using social engineering in DMs!

Once again, ignore them, if you are worried about stolen seed - migrate funds via:

…or manually.

If you still have to revoke approvals at Tron — you may use with caution!

Support is very important to me, with it I can spend less time at work and do what I love — educating DeFi & Crypto users!

I don’t have as much money as the fictional character in our essay, but your support helps me to exist 🙂

If you want to support my work, you can send me a donation to the address:

Subscribe to Officer's Blog
Receive the latest updates directly to your inbox.
Mint this entry as an NFT to add it to your collection.
This entry has been permanently stored onchain and signed by its creator.