Someone sent ERC20 from my cold storage

[hopenotlate]

Can people transfer money from cold wallet? Without having them? Isnt it the main purpose of Cold Wallets to keep assets safe?

No they can't , luckily.

Thread title is a bit misleading, if you read carefully opening post you first line says :

This is not my address but its a similar transaction.

Basically attackers create and use very similar addresses to the ones the victim of the attack is sending money to , so that a "malicious" address is stored in tx history of the victim  : if the victim doesn't doublecheck carefully every address they are sendin money to but lazily copy them from theiy TX history they risk to lose their funds.

[albon]

Can people transfer money from cold wallet? Without having them? Isnt it the main purpose of Cold Wallets to keep assets safe?

Mate, cold wallets are safe, there is no need for panic, and it is good that you saw such a topic in order to know this trick that the scammer did so that you and everyone else do not fall victim to it, we just have to focus and take some time and not copy the addresses of the wallets that we received from or sent to from the transaction history, because most likely there will be a scammer’s wallet that we will think is a safe wallet to transfer our funds to and it is not, so we have to carefully copy the deposit wallets from the exchange platforms or from the person to whom the funds are to be transferred, with careful focus, without resorting to the transaction history, because the scammer takes advantage of the victim's inattention and lack of focus in order for the victim to copy his wallet address which is similar to the addresses of the victim's wallet in the transaction history.

[lalabotax]

This transaction is suspicious and after reading some replies, I there are some scams like this. The wallet address is actually different, but they have the beginning and also last characters that are similar. Can someone copy and make quite a similar wallet address? If this is available, well, I am a little bit worried because commonly, we will only focus on some first and last characters of our wallet. We may also not focus on correcting all characters on the wallet, right? So, when we are seeing the transaction, we can copy and paste again the wallet address and search for the replacement or find a tool to ensure that the wallet is exactly the same or not. But, exactly, if we are not careful enough, we will directly think that this is our transaction in a similar wallet and we may panic about the situation certainly.

[oliver_g]

I lost by this vulnerability 100000 dollars.
https://bitcointalk.org/index.php?topic=5425022.0

[adaseb]

Yes I didn’t know that you could make transactions from any address as long as it’s 0 and make it appear like a legit transaction.

Either way the nonce is not needed to do this apparently because the nonce is skipped with the 0 erc20 transaction. Why they did this who knows. Maybe for some smart contract feature. Either way it provided a huge scare to see it come out from my cold storage wallet.

[Ani1985]

Be aware of the scammers who send tokens to the wallet, usually they include the URL and then ask us to connect to the wallet so that when we connect then they have gotten our private key, the best step is to immediately move assets to other wallets if they have already connected to websites that we don't know .