News Banner

Web3 Attack Manipulates Transaction Simulations to Steal Cryptocurrency

2 Mins Read

PureVPNNewsWeb3 Attack Manipulates Transaction Simulations to Steal Cryptocurrency

Cybercriminals are using a tactic known as “transaction simulation spoofing” to steal cryptocurrency, with a notable incident resulting in the theft of 143.45 Ethereum, valued at roughly $460,000.

This method of attack, identified by ScamSniffer, exposes a vulnerability in the transaction simulation features of contemporary Web3 wallets, which are designed to protect users from scams and malicious activities.

How Does the Attack Work?

Transaction simulations in modern Web3 wallets allow users to see the expected outcome of a blockchain transaction before it is finalized. It is designed to increase security and transparency by showing details like the cryptocurrency amount being transferred, associated fees, and other changes that will happen on the blockchain.

However, attackers have turned this security measure into a vulnerability. Here is a step-by-step breakdown of how they do it:

  1. The Setup: Victims are tricked into visiting a fake website that looks like a legitimate platform. 
  1. The Bait: On the site, victims are prompted to click on a “Claim” function, which supposedly awards them a small amount of Ethereum. 
  1. The Switch: After the transaction is simulated but before it is executed, the attackers change the underlying contract’s state to alter what the transaction will actually do. 
  1. The Theft: Believing the simulation, the victim approves the transaction. This allows the fake site to empty out the victim’s wallet, redirecting all funds to the attacker.

An unfortunate user lost 143.35 ETH due to signing the transaction 30 seconds after such a deceptive change was made by the scammers.

“This new attack vector represents a significant evolution in phishing techniques,” says ScamSniffer.

Related Read: Best VPN for Crypto Trading in 2025

Rather than relying on simple deception, attackers are now exploiting trusted wallet features that users rely on for security. “This sophisticated approach makes detection particularly challenging.”

How to Protect Yourself

ScamSniffer, the blockchain monitoring platform that discovered the attack, advises Web3 wallet developers to enhance security by:

  • Synchronizing simulation refresh rates with actual blockchain block times: This would ensure that transaction previews are always up-to-date, minimizing the risk of outdated information leading to fraud.
  • Forcing a refresh of simulation results before any critical operations are finalized: By doing so, users would see the most accurate, current state of their transaction right before they commit to it, reducing the likelihood of deception.
  • Introducing warnings that alert users to potential expiration or changes in the transaction state: These alerts would notify users to double-check and confirm the details of transactions if there have been any changes since the simulation was first displayed.

From a user standpoint, the takeaway is clear: not all simulations are reliable. Exercise extreme caution with “free claim” offers, especially on lesser-known websites, and always use verified decentralized applications (dApps).

Related Read: Access Any Crypto Trading Platform Securely

author

Anas Hasan

date

January 13, 2025

time

4 weeks ago

Anas Hassan is a tech geek and cybersecurity enthusiast. He has a vast experience in the field of digital transformation industry. When Anas isn’t blogging, he watches the football games.

Have Your Say!!

Join 3 million+ users to embrace internet freedom

Signup for PureVPN to get complete online security and privacy with a hidden IP address and encrypted internet traffic.