Study Links 4,224 Phishing Contracts to $3.48M in Losses

Researchers identified 4,224 smart contracts designed to exploit transaction-simulation features in cryptocurrency wallets, according to a preprint published on arXiv on July 30. The contracts deceive users by displaying benign previews during simulation while redirecting actual deposits to attacker addresses on-chain.

The study linked these contracts to 5,742 victim addresses and up to $3.48 million in historical losses across Ethereum, BNB Smart Chain, Avalanche, and Polygon. Ethereum accounted for 91.5% of the identified losses.

How the Attack Works

Phishing contracts contain conditional branches that produce different results during transaction simulation versus on-chain execution. Storage-control variants change contract state, such as blacklisting a user address, between the preview and actual execution. Timestamp-based contracts exploit later block times, while gas-control contracts behave differently depending on the gas limit supplied.

The attack exploits a core wallet feature. MetaMask documentation states the wallet “estimated balance changes predictions and warns that the final outcome is not guaranteed.” Users who rely on the preview without reading this warning may approve transactions expecting one outcome and receive another.

Detection and Scale

Researchers used SimGuard, a contract-bytecode detector, to identify the malicious contracts. The study evaluated SimGuard on 44 contracts, including 30 generated with Gemini, an AI tool. The 4,224 contracts were associated with 6,223 victim transactions.

Etherscan, the blockchain explorer, labeled many of these contracts as phishing. One cited transaction from January 8, 2025, involved a Claim() call moving 143.45 ETH to an attacker address, illustrating the scale of individual losses.

Recommendations

The researchers recommend that users re-run simulations when contract state or gas fields change, using the actual request gas limit and price, and testing block-number and timestamp inputs. Wallet developers are advised to display the gross outgoing amount alongside net balance change to prevent confusion with negligible refunds.

The study has not undergone peer review. The researchers did not identify which wallet versions, settings, or simulation backends were used by historical victims, limiting the ability to attribute vulnerability to specific wallet configurations.