Researchers just uncovered 4,200 malicious smart contracts that successfully tricked 5,700 victims into signing away their crypto
A July 30 arXiv preprint reports phishing contracts that exploit wallet transaction simulations: a preview can show a tiny gain or refund while the on-chain execution drains the user’s deposit. Using SimGuard, it identified 4,224 simulation-based phishing contracts across Ethereum, BNB Smart Chain, Avalanche, and Polygon, linked to 6,223 victim transactions, 5,742 victim addresses, and an estimated $3.48 million in historical losses. The loss figure is an upper bound because some attacker test activity may be included. Most losses were attributed to Ethereum. The core trick is branch divergence between simulation and execution, driven by changing contract state, timestamps, or gas conditions. In tests, even a 1 wei return could make previews look positive while hiding the full outgoing amount. The work is not peer reviewed and contains some internal inconsistencies, so exact counts and dates remain uncertain. Recommended defenses include re-simulating when state or gas inputs change and displaying gross outflow alongside net balance change.
