Binance smart chain and 0 dollars transactions attack

[MikkisJ]

There is an attack going on where transactions are created that show transactions going out of your account that have 0 tokens moved.

The attacker sends 0 tokens from your address without your private keys. The address is very similar that you send tokens to. Then a user copies address and accidentally sends tokens to scammer.

Here you can see 20 such 0 token transactions.
https://bscscan.com/tx/0x8af45041085d513da6c5acb06bc82acf108ccc08d7ae3a2b7dbe4671c2d75d70

[1714249017]

1714249017

[1714249017]

1714249017

[1714249017]

1714249017

[1714249017]

1714249017

[1714249017]

1714249017

[zasad@]

Everything is very interesting, but I did not understand how a fraudster can create transactions without private keys.
It is very difficult to generate a similar address so that the first and last 3-5 digits are the same. Write more information about fraud.

[seoincorporation]

The attacker sends 0 tokens from your address without your private keys. The address is very similar that you send tokens to. Then a user copies address and accidentally sends tokens to scammer.

This is impossible.

People can't send coins from your address without your private key, but what they can do is generate those transactions with a smart contract once users have interacted with it.

And is important to say this transaction had a cost, it wasn't totally free, the one who spent cero dollars with multiple inputs and outputs had to pay a transaction fee for it. So, if this is an attack, I don't think it will be brute-forced because each transaction has a cost.

[Yogee]

This is confusing. Are these really coming from compromised wallets? What if these addresses are generated by the same person or "attacker" and he just wants to spam the network? It looks like a lot of work but I find that more plausible than sending 0 tokens without a private key or seed phrase.

[o48o]

There is an attack going on where transactions are created that show transactions going out of your account that have 0 tokens moved.
The attacker sends 0 tokens from your address without your private keys. The address is very similar that you send tokens to.

It sounds like this is either error in translation or you have completely misunderstood how addresses and private keys work. If someone could send 0 token transactions from your wallet without your private key, this would be a serious issue that would have been talked about for years now.

Then a user copies address and accidentally sends tokens to scammer.

Here you can see 20 such 0 token transactions.
https://bscscan.com/tx/0x8af45041085d513da6c5acb06bc82acf108ccc08d7ae3a2b7dbe4671c2d75d70

This doesn't even make any sense. Why would i copy some random address and from where? And similar addresses? What are you even talking about?

[blockman]

The attacker sends 0 tokens from your address without your private keys.

Of course, anyone can send transactions to us without having the need our private keys. But with that having 0 tokens sent, it's making me believe that this is just another dust attack.
From what I think, maybe there's a fake token from the attacker that sends it to anyone that he's got their addresses and that's to know if the address owner is responsive or active because they'll eventually move that away from that wallet. Also, don't click those tokens because they'll direct you to their website and with an interest of exchanging them, that's probably where the scam starts.

[JunkieMiner]

Recently, I got 2 transactions consisting of 0 USDC in my trust wallet but didn't understand what this all happening, and the most ridiculous think is that the 2 addresses were completely different from each other, I had checked them at BSc scan, but the wallet was fully new created and that was their first transactions.

[Adbitco]

Actually sometimes is possible because whenever you tried to swap token from dex immediately you swapped then some tokens are instantly sent to you via same address, I think it was same thing that occurred here. But if it happens that your wallet is compromised then I would advise to you to instantly move every valuable asset in your wallet before any further damages that might likely occur in future because basically the wallet is not safe anymore.
Create new wallet and move all valuable asset out from that same wallet.

[cryptoaddictchie]

Im not sure how its possible. But in order to create a transaction from the wallets, someone must have your private keys. Maybe those send transactions are wallets from same guy who knew those different wallets. If you see your wallet there means he got an acess on your wallet. Not sure how he make the transaction confirmed. Maybe this is a smart contract interaction on a dapp or what.

[Jackl87]

There is an attack going on where transactions are created that show transactions going out of your account that have 0 tokens moved.
The attacker sends 0 tokens from your address without your private keys. The address is very similar that you send tokens to. Then a user copies address and accidentally sends tokens to scammer.
Here you can see 20 such 0 token transactions.
https://bscscan.com/tx/0x8af45041085d513da6c5acb06bc82acf108ccc08d7ae3a2b7dbe4671c2d75d70

Well first of all thank you for the warning and the heads up. I am not really sure though how this transaction attack would work. As others in this thread have already said, there should be no way that a scammer can send tokens from your wallet if he does not have access to your wallet which means to your private key and if he would have access to it then he definitely would not send 0 token transactions first. He would instead just send all of the funds from your wallet to a wallet that he is controlling. So i don't think that this scam works as you said, but i also don't now how it could work any other way. This kind of scam would be new to me.

[goaldigger]

Is this like the hackers sending fake tokens on your account? If yes then probably this is their way to hack you so better not to make any transaction with it and just ignore it. There’s a lot of hackers out there, waiting for the opportunity so stay cautious. That is something suspicious though since you can only create transaction once you have the access on your wallet, which I think hackers still have no access, whatever it is be careful and protect your crypto as much as possible.

[serjent05]

Everything is very interesting, but I did not understand how a fraudster can create transactions without private keys.
It is very difficult to generate a similar address so that the first and last 3-5 digits are the same. Write more information about fraud.

If this is true, I believe this is the most sophisticated hack ever happening in a Wallet.  Though I am still baffled by how this kind of hack happens, people gaining the access to your wallet.dat, if that was it then it is possible that the person who owned the address is a victim of the malware.

It can be 1 of the stated wallet-stealing malware like

InnfiRAT malware lurks in your machine to steal cryptocurrency wallet data
New ‘BHUNT’ malware is targeting crypto wallets of Indians
Everything you need to know about Mars Stealer
Bitcoin stealers: malware that raid crypto wallets

[abel1337]

Just like others, I don't see how it is possible to send a token without an existing wallet / private key. Another point is it is hard for someone to create a wallet address that is similar to yours. Personally for years now, I haven't seen any wallet address that is nearly similar to my wallet address or I could mistakenly thought it was my wallet address. Let's say that what you are saying is true, I don't see any point that the hacker made this things to just earn 0 value transaction attack. Or maybe we are all wrong since I myself is also confused on how this works. I'm just thinking it's logically hard or nearly impossible. 

[vv181]

As others have said, it is very unlikely to create a transaction without the address private key or prior interaction without a smart contract. I also don't see which address that mentioned being similar, maybe anyone could point me to any of it?

For the latter part, it makes no sense if the user truly intended to send or receive some token over some platform address, they won't be copying directly from the transaction history parts.

You should elaborate more if you suspect this is an attack and detail the process of how the user could get scammed.

[MikkisJ]

Those transactions send 0 tokens from possible victims wallets to scammer's wallet. It's possible to send 0 tokens from your address without private keys because the system accepts them because transaction is zero.

The scammer creates address that is similar to address you sent tokens to. For example if you send 1000 Tether USD to you binance address ending with 12345, then the attacker send a minute later 0 Tether USD from your address to his address that looks like your binance address, it also ends with 12345. Scammer hopes you copy paste his address from bscscan and he hopes you send to his address instead of your binance address.

[zasad@]

Those transactions send 0 tokens from possible victims wallets to scammer's wallet. It's possible to send 0 tokens from your address without private keys because the system accepts them because transaction is zero.

If someone can send 0 tokens from my address, then he can reset my wallet, because for each transaction you need to pay a commission.
This is not possible without a private key. I think that you do not understand how blockchain binance works.

The scammer creates address that is similar to address you sent tokens to. For example if you send 1000 Tether USD to you binance address ending with 12345, then the attacker send a minute later 0 Tether USD from your address to his address that looks like your binance address, it also ends with 12345. Scammer hopes you copy paste his address from bscscan and he hopes you send to his address instead of your binance address.

I chose a random address, try sending 0 tokens from this wallet.
https://bscscan.com/address/0xbc5703a67df4a335bbd7d2fb163d37ac5799268c

[o48o]

Those transactions send 0 tokens from possible victims wallets to scammer's wallet. It's possible to send 0 tokens from your address without private keys because the system accepts them because transaction is zero.
-cut-

Ok, i would liket to see anyone proving this as it sounds absurd. Even asking this makes me sound like a fool but:

Can someone make transaction from this address to literally any address without having private key for that address?

And please explain to me why i can't find info on something even related to this or why no one is talking about this? Can you also sign messages with other people's wallets while you are at it?

[MikkisJ]

This address had USD transaction.
https://bscscan.com/address/0x568ea44e79f404186409fb743e2b25c3ef49426c#tokentxns

Here he sends 2751 dollars to somebody, maybe his second address, or exchange.
https://bscscan.com/tx/0xb5ae05099b8197f1a6dd01d02b27511f23b4ab4625a8356cb92c249fdd8b7b09

The receiver is
0x3A06a19ee040322edF79e259e9830B02a65020b6

Then the scammer sends 0 dollars from 0x568ea44e79f404186409fb743e2b25c3ef49426c. He doesn't have private keys. But because it's 0, the system accepts it.

The scammers sends 0 to his own address
0x2b63c5514da212b24433b7bfe3ccac2b41f020b6


This address is similar to
0x3a06a19ee040322edf79e259e9830b02a65020b6

So then the scammer hopes that the owner of 0x568ea44e79f404186409fb743e2b25c3ef49426c sends to 0x2b63c5514da212b24433b7bfe3ccac2b41f020b6 instead of 0x3a06a19ee040322edf79e259e9830b02a65020b6.

[MikkisJ]

Those transactions send 0 tokens from possible victims wallets to scammer's wallet. It's possible to send 0 tokens from your address without private keys because the system accepts them because transaction is zero.
-cut-

Ok, i would liket to see anyone proving this as it sounds absurd. Even asking this makes me sound like a fool but:

Can someone make transaction from this address to literally any address without having private key for that address?

And please explain to me why i can't find info on something even related to this or why no one is talking about this? Can you also sign messages with other people's wallets while you are at it?

0 tokens can be sent by anyone. it is discussed here
https://ethereum.stackexchange.com/questions/140214/fake-0-token-transaction-on-bsc

[oliver_g]

I lost by this vulnerability 100000 dollars.
https://bitcointalk.org/index.php?topic=5425022.0