Malicious Smart Contracts Tricked Over 5,700 Victims Out of $3.48 Million

Researchers have discovered over 4,200 malicious smart contracts on various blockchain platforms that successfully tricked more than 5,700 victims into signing away their cryptocurrency. The study links these contracts to approximately $3.48 million in losses.

The contracts, known as transaction-simulation phishing contracts, use a technique called simulating transfers using safety tools inside crypto wallets. This can show a small gain even when the final transaction sends the user's deposit to an attacker.

According to the study, 91.5% of the losses are attributed to Ethereum, with about 83% of the cross-chain total coming from its largest inferred cluster. The authors used SimGuard, a contract-bytecode detector, to identify these malicious contracts across Ethereum, BNB Smart Chain, Avalanche, and Polygon.

The study recommends that users re-run simulations when relevant contract state or gas fields change, using the gas limit and gas price in the actual request, and testing current and future block-number and timestamp inputs. This is crucial in preventing further losses from these malicious contracts.