Watch out for this NEW TransferFrom Zero Transfer Scam!

[wwzsocki]

Watch out recently there is new scam developed TransferFrom Zero Transfer Scam!

From some time i was getting very strange incoming transactions just after I sent anything on TRON network in which usually 4 first and 4 last numbers matched perfectly with the address of my last transaction.

https://tronscan.org/#/transaction/71f021d17154a7a476597854d1bcf0af192da2b040cdf56bcbffa1ae38b66bd6

I assume they count on copy paste mistake, many times I use addresses from wallets to send transactions back and forth and usually when I check then always 4 first and last numbers, I think majority of us do and this is big mistake!

So REMEMBER to check addresses very carefully always confirm with the source!

Lately scam changed, I think it was too costly to send so many transactions, and from few days I see OUTGOING (NO VALUE 0$) transactions from my wallet that I haven't initiated!

https://tronscan.org/#/transaction/c9362f62af918f6197d15301de5277ff733d7b9a3f06dfa0919271bd15bea1d8

yes, scammers initiate OUTGOING transaction (0$ value) from our wallets!

Luckily explorers already are aware of this and I see today big warning message when I check some of these suspicious transactions.

There is link in warning message that sent me to this article "SlowMist: Be Wary of the TransferFrom Zero Transfer Scam"

https://slowmist.medium.com/slowmist-be-wary-of-the-transferfrom-zero-transfer-scam-c64ba0e3bc4d

READ IT! and be aware when you copy paste any address to check it fully, not only few first and last numbers because this is not enough, as you see above scammers try to take advantage of that!

REMEMBER: "it's not acceptable to copy from past transactions and/or users should go to the actual destination to get the address"

[hosseinimr93]

Some days ago, someone reported the same thing on binance smart chain. So, it seems that this type of scam isn't limited to Tron blockchain.
Visit the following topic for more information.
I got scammed out of 100000 dollars by fake 0 dollars withdrawal on BSC

[JeromeTash]

READ IT! and be aware when you copy paste any address to check it fully, not only few first and last numbers because this is not enough, as you see above scammers try to take advantage of that!

Yeah, the scam now looks to be the common one now after the infamous multisignature scam. I am yet to see such an exploit on POW networks (I stand to be corrected) all i see are POS networks

People also ought to copy addresses from the exchange or wallet they are sending funds not and no necessarily block explorers. Copying from a block explorer exposes on to a higher risk of getting scammed.

[Saisher]

READ IT! and be aware when you copy paste any address to check it fully, not only few first and last numbers because this is not enough, as you see above scammers try to take advantage of that!

Yeah, the scam now looks to be the common one now after the infamous multisignature scam. I am yet to see such an exploit on POW networks (I stand to be corrected) all i see are POS networks

People also ought to copy addresses from the exchange or wallet they are sending funds not and no necessarily block explorers. Copying from a block explorer exposes on to a higher risk of getting scammed.

This is new and we have to get it out to the whole community although I have seen this warning in many articles we have to keep pushing this, these scammers have found a way for a new scheme, they just find out that many are copying from explorers so they device or create a plan to target this, honestly I also used to copy from explorer and bookmark these explorers because there is a copy option there, but after the clip malware I make sure to only copy from my wallet.

[wwzsocki]

This is new and we have to get it out to the whole community although I have seen this warning in many articles we have to keep pushing this...

fully agree with you I see that member that was scammed 100K asked to share this on Reddit because he can't so would be great if somebody can do it to spread the word further

doesn't matter if that was his mistake that he used this address, this is scam and he was scammed, not important that in the end if you fell for this you are responsible because you haven't be careful enough, this is still scam

and despite everything not so stupid one as we see people lost already a lot of money

[suchmoon]

Tone down the alarmist BS. No one is initiating a TX from your address. Poorly-implemented explorers/wallets incorrectly show interactions with poorly-implemented token contracts. These 0s should never been visible in the transaction history of the address that didn't sign the token transfer.

Reason #145905 to stop shitcoining.

[crwth]

What's important to see in this situation is that you don't need to panic if you have correctly made sure that your private keys are safe and you know that you haven't installed anything malicious on your device etc., you should be safe. Something that could go wrong here is that you need to check the transferring address thoroughly.

The part where the user "thinks" that their wallet is compromised is when the attacker grabs the opportunity to steal/rob the user from redownloading.

[wwzsocki]

Tone down the alarmist BS. No one is initiating a TX from your address...

I see outgoing transactions from my trust wallet, and I haven't sent them, so they are initiating them no BS here!

It is possible to initiate a transfer of 0 from any user’s account to an unauthorized account without failure, as the TransferFrom function of the token contract does not require that the approved transfer amount be greater than 0. This condition is utilized by the malicious attacker to repeatedly launch TransferFrom actions to active users in order to trigger these transfer events. Apart from TRON, we cannot help but worry if the same scenario would occur on the Ethereum network.

https://slowmist.medium.com/slowmist-be-wary-of-the-transferfrom-zero-transfer-scam-c64ba0e3bc4d

"alarmist" tone is on purpose - I hope as many people as possible will read it and not fall for this scam


PS
I thought you already forgot about me @suchmoon, also am happy to see you around 

[FatFork]

Tone down the alarmist BS. No one is initiating a TX from your address...

I see outgoing transactions from my trust wallet, and I haven't sent them, so they are initiating them no BS here!

They can initiate TransferFrom function of the token contract that does not require approval only if the transaction amount is zero. Read the documentation on how the TransferFrom function works. All networks with smart contract functionality are susceptible to this type of "attack". So suchmoon is right. This can be toned down—it's nothing new.

No one can steal anything from your wallet using this method without you making a stupid mistake (such as copying the recipient's address from blockchain explorer). It's basically the same as fake airdrops.

[Pmalek]

What is important to remember with this type of attack (if it even deserves to be called that) is that no one can steal your coins and tokens from you. This only works if a user makes several mistakes when sending Tron or Tron-related tokens.

- If you checked and verified the entire address that you want to send funds to, this fraudulent trick wouldn't work because you would notice the different characters.
- If you copy the addresses you send coins to from a blockchain explorer or your transaction history without verifying them properly, it's your own fault that you got scammed.
- Take the time to check your addresses properly and don't take shortcuts because you are lazy or in a hurry. And if you do, be ready to face the consequences.   

[wwzsocki]

What is important to remember with this type of attack (if it even deserves to be called that) is that no one can steal your coins and tokens from you. This only works if a user makes several mistakes when sending Tron or Tron-related tokens...

In my opinion we need to share this as much possible to warn people, even experienced users make mistakes when send transactions, I am the best example, so this scam is not so stupid and takes advantage of that. As we can see they already succeed and scammed for sure many people one of them reported 100K lost to this.

Despite we call that trick, or attack that don't deserve to be called like that, is not important, let's call it simply what it is - SCAM.
People loose money all the time, even as we speak and I am really surprised to see some opinions that this is our fault that we don't check addresses very carefully.

there are many situations in real life when yes, indeed you are in hurry or make simple error and copy paste one of many scam addresses that are targeting every incoming transaction in wallet. They count exactly on that one small mistake we all can do because we are humans, don't forget that few first and last numbers match the correct address. This is why this scam is so brilliant and as we see effective, despite is not the most sophisticated one.

They can initiate TransferFrom function of the token contract that does not require approval only if the transaction amount is zero...

Yes scammers can send only ZERO VALUE transactions from our wallets and this is already added in my post. When I check TRON explorer and incoming transactions, I see that this TransferFrom Zero Transfer Scam is executed on multiple transactions.

Few days ago it was visible but I need some time to find them, today I had no problem finding them in the flow of newly sent transactions, literally every third of fourth was marked with warning message, looks like this keeps spreading, they are gaining momentum.

I hope that this is enough for developers to look at that, if they could implement such update that at least will hide/remove/mark such a ZERO VALUE transactions properly, that could resolve that problem at least to to some extend.

[suchmoon]

Yes scammers can send only ZERO VALUE transactions from our wallets and this is already added in my post. When I check TRON explorer and incoming transactions, I see that this TransferFrom Zero Transfer Scam is executed on multiple transactions.

You're diluting the issue by insisting that scammers somehow initiate transactions. They don't. Only someone who has the keys can do so. Shoddily coded wallets and/or explorers and/or token contracts don't change how the blockchain works. The issue is elsewhere - users blindly copying addresses from untrusted sources. Even if zero transfers are patched out of explorers/wallets/contracts/etc, scammers fill find other ways to take advantage of lazy users as long as they keep falling for stupid shit like that. For example by sending perfectly valid 1 sat (or whatever the dust unit is in shitcoins) transactions to the target's wallet.

[wwzsocki]

You're diluting the issue by insisting that scammers somehow initiate transactions. They don't... The issue is elsewhere - users blindly copying addresses from untrusted sources....

You're diluting the issue by insisting that the problem is elsewhere: "users blindly copying addresses from untrusted sources".

Sending crypto transactions was never easy and that was/is always the first obstacle for any new  crypto user, especially today with so many chains, contracts, bridges this is even more advanced task

looks like you don't know how hard sending transactions in real life is? Have you ever done ATM withdrawal, have you ever dealt P2P?

if not then believe me you can be distracted and such scam transactions in our wallets, despite sent or not doesn't help, even more, they are there on purpose as you know because scammers are really clever and take advantage on our bad behavior

Real life example

by ATM withdrawal from known service, one receives QR code to scan the address where to send crypto, of course when one scan it see something like LTC33KS4f948484kfjjf8988:300$ depends on amount and crypto of choice it can be even more complicated, of course whiteout indication which chain to use!!! then one need to manually delete what is not correct, and paste where it needs to be pasted, of course don't know that from start, one think have the correct address, all starts when try to send it and see message :"address not correct" or something similar, immediately start to be nervous, if we add that one is on phone, need to check addresses, explorers back and forth, there are many things that can go wrong even in peaceful environment, where one is super focused, don't mention small local store, when there is 40 degrees outside...

I need to add that scanned address from QR code is not visible right away, it needs to be pasted somewhere like notepad to be able to decipher it, when copy pasted into tiny place in some wallet withdrawal tab all one see is bunch of numbers and later message "wrong address" when hit send

believe me experienced user that have done transactions multiple times on many chains, using all kinds of bridges and wrapped coins, have hard time to figure everything out and do that correctly,  this is only one simple example where such fake 0 value transactions in our wallets are like ticking bomb and are placed there exactly for that purpose

Maybe I am diluting the issue and partially i am doing that on purpose as I have told few times only for one reason to make it sound more alarming, but saying that this is only because "users blindly copying addresses from untrusted sources" is also "diluted"

[suchmoon]

You're diluting the issue by insisting that scammers somehow initiate transactions. They don't... The issue is elsewhere - users blindly copying addresses from untrusted sources....

You're diluting the issue by insisting that the problem is elsewhere and that hall blame is on users blindly copying addresses from untrusted sources.

[...]

None of what you said has anything to do with scammers initiating transactions from your wallet. That simply doesn't happen if you keep your keys safe.

With this issue, users don't need to worry about scammers stealing their funds without their consent. They need to worry about voluntarily sending funds to a wrong address, regardless of whether they were targeted by a zero token transfer, a phishing e-mail, or any other distraction.

Maybe I am diluting the issue and partially i am doing that on purpose as I have told few times to make it sound more alarming, but saying that this only because "users blindly copying addresses from untrusted sources" is also totally "diluted

I don't see how fearmongering with a non-existent threat is helping here.

[wwzsocki]

I don't see how fearmongering with a non-existent threat is helping here.

the only person that undermine importance of this "non existed thread" is you @suchmoon

explain that to ordinary people when they see this in their wallets



and to the user that lost 100K that talking about "non-existent threat" is not important

ok @suchmoon wish you a nice day further, as always happy you join my threads

[suchmoon]

I don't see how fearmongering with a non-existent threat is helping here.

To make more awareness, to spread the word about this problem

That's just one possible attack vector that will likely get patched out, and possibly even create false sense of security for some users who instead of being advised to change their behavior (like copying addresses from wrong sources) were told that big bad scammers could initiate transactions and now they can't anymore so all is good.

Not only do you fail to give proper advice (e.g. copy the address only from the actual destination, like an exchange you're sending money to) but you're making it sound that it is acceptable to just copy it from past transactions.

I assume they count on copy paste mistake, many times I use addresses from wallets to send transactions back and forth and usually when I check then always 4 first and last numbers, I think majority of us do!

It's a horrible practice. Don't do that.

and the only person that undermine importance of this "non existed thread" is you @suchmoon

explain that to ordinary people when they see this in their wallets

The user has to take multiple actions (fail to notice the difference in the address, copy/paste the wrong address, fill in the amount, click a button to send, possibly click some confirmation) to get scammed. It's like copying a random address from a spam e-mail and sending money to it. Makes no sense. People who fall for that would for just about anything, so what good does it do to confuse them with claims like "scammers can initiate transactions from your wallet"?

Anyway, it's obvious you think fearmongering is the way to go, so carry on. It's a shame as it would be likely be more effective to direct your effort to the root cause.

[wwzsocki]

Not only do you fail to give proper advice (e.g. copy the address only from the actual destination, like an exchange you're sending money to) but you're making it sound that it is acceptable to just copy it from past transactions.

This is totally not true what you are implying here.

...Anyway, it's obvious you think fearmongering is the way to go, so carry on...

My goal was to get the attention of others, I haven't thought about "fearmongering" anybody

For sure undermining importance of this scam and blaming users that are victim is at least odd

...It's like copying a random address from a spam e-mail and sending money to it. Makes no sense. People who fall for that would for just about anything...

for me is clear that you never send many transactions, day after day, when you have to do it multiple times P2P or in not friendly environment were is easy to get distracted, and that you will keep diluting anything I write about this scam, this is why I feel like kicking with a horse and want to end this conversation, from other side our discussion keep this thread on top of this board, so is seen by many more users each hour (which is my goal) so keep it rolling

[Pmalek]

In my opinion we need to share this as much possible to warn people.

Of course, no objections there. Knowledge is power. The more information is out there, the more people will know about it.

People loose money all the time, even as we speak and I am really surprised to see some opinions that this is our fault that we don't check addresses very carefully.

If a user sends money to the wrong address, of course it's the user's fault because they didn't check the address properly. If a user copies and sends to an address without checking the entire address, it's again the user's fault.

there are many situations in real life when yes, indeed you are in hurry or make simple error and copy paste one of many scam addresses that are targeting every incoming transaction in wallet. They count exactly on that one small mistake we all can do because we are humans, don't forget that few first and last numbers match the correct address.

I am sorry but I can only repeat what I already said. There are no second chances in crypto. If you are in a hurry and you make a mistake, that's it. You will get your coins back only if the other party is honest and sends them back, which is out of the question for scammers. Take your time and verify the receiving address thoroughly, no exceptions. There is a saying: "It's better to be safe than sorry". 

Real life example...

That's got nothing to do with the topic of discussion. Your thread isn't about best practices of how to use crypto ATMs. It's about people copying similar addresses from blockchain explorers or transaction histories (for whatever reason) and failing to verify if they have copied the correct address or not. Initiating a transaction the proper way keeps you safe from this threat. That means accessing your wallet software/exchange, copying the address from there, verifying you have the correct one, pasting it wherever it needs to be pasted, and again checking to see if the same address got pasted. Not following the correct procedures can get you into trouble as is evident from the users that got tricked by this. 

[suchmoon]

Not only do you fail to give proper advice (e.g. copy the address only from the actual destination, like an exchange you're sending money to) but you're making it sound that it is acceptable to just copy it from past transactions.

This is totally not true what you are implying here.

I'm not implying anything, just making an observation on your OP and providing a quote that led me to said observation. If you think it's not acceptable to copy from past transactions and/or users should go to the actual destination to get the address - then perhaps you should state so in the OP.

Also you're saying "check addresses very carefully" and "check it fully" but what are you checking the address against? Presumably some known good/trusted source? So why not use that to begin with?

[wwzsocki]

...it's not acceptable to copy from past transactions and/or users should go to the actual destination to get the address - then perhaps you should state so in the OP.

sure you are right I will add it in opening post

...why not use that to begin with?

I thought it is clear that one needs to check address very carefully and of course it needs to be an trusted source to compare with

but what could be better as our wallet? or explorers we all use to confirm and check transactions? what left?

only direct contact with the other party and confirming the address, usually if we need to send multiple transactions during longer period of time one checks his wallet and use old once already used/confirmed at the start of cooperation, TBH i don't know any other way, if you do please tell me?

many times when I confirm address I hear: "send me to the previous addy, use the one we used lately/last time, etc" not always they are able to check it on the go, the only way then is to go to your wallet or explorer and here we are now on the minefield of 0value transactions

these transactions are sent immediately after wallet receives any incoming transaction, additionally majority of wallets, exchanges, show only few first and last  numbers, this is common as behavior to check also only few of them (I am the best example) so yes we need to change a lot as we see, and for sure we as community should start to make noise about this.

We should help each other to write great, informative content and warn others - not argue about this or look for possibility to undermine the importance due to personal conflicts.