securitycenter

We are used to hearing warnings about phishing via WhatsApp, messages, fake links, and emails, and we know how to deal with and warn against them.
But have you ever experienced a phishing attempt via a token?
Today, while checking my Web3 wallets, I noticed three unsolicited incoming transfers in the history of one wallet without my knowledge (I did not participate in any on-chain activity, nor was this token distributed as an airdrop or giveaway, nor did I exchange any token with anyone to receive this currency).

I had read about this type of token before, but this was my first direct experience with this kind of phishing. I’d like to share it to raise awareness and caution.

1. The tokens exists on the Plasma network and uses a website as its name .
2. This fake token only appeared in my wallet after I clicked "Add Token" – Binance had actually blocked this fake currency because the sender’s address was flagged as phishing and fraudulent. Of course, with my strong knowledge and understanding of what I was doing, I added it to test this type of phishing! I do not recommend experimenting at all – you are just one click away from being scammed !

3. After adding the token to my wallet, it appeared with a value = 0, an unfamiliar name, and a huge quantity!

I went to blockchain scan sites to research the contract address that sent me these tokens (it was sent from 3 different addresses).

I found that the same amount of fake tokens had been sent to a large number of wallets, and fortunately for me, I was one of them. Why fortunately? Because I actually wanted to test this method, understand it up close, and warn others about it. And also – importantly – I discovered which close person shared my wallet address! How? I keep a record of all my blockchain interactions with people for various reasons, but this wasn't one of them 😂

Now, after reviewing the sender’s address transactions and the addresses that funded it, I found a large number of wallets sending phishing tokens.
They allocate a small amount of money to pay the Network fee and wait until someone accepts these fake tokens (they assume the person will try to sell or send them). The moment the person interacts with the token, they receive a request to "Approve" the token to send it.

And here lies the disaster: When you grant approval, you have given it permission to access your funds. Some malicious contracts allow unlimited withdrawal from the wallet. The result: All your money can be withdrawn within seconds (or, the scammer might not withdraw immediately but keeps the permission to control your funds until you deposit large amounts – scammers can wait for weeks or months to get the largest amount possible). This means the scammer relies on your curiosity, greed, and lack of knowledge.

But the important point here is monitoring approvals regularly (you should revoke any approval you did not authorize or any dApp you did not enable).

And here we come to a website that appears as the token’s name (#RedFlagAlert – do not visit the site at all).
When opening this site – which is 100% fraudulent – it will ask you to connect your wallet to claim a large sum (to tempt you and cloud your judgment) and will then ask for your wallet keys (remember: no official site ever asks for your private keys or seed phrase – connecting a wallet to sites is done via approval inside the wallet application itself).

Here, we move from fraud via a malicious contract to fraud via theft of your wallet keys and complete access to your assets.
Even if you make any mistake out of ignorance, you can still transfer your assets if you are aware and know about the possibility of being scammed. Why? Because scammers have a large number of targets and thus follow a periodic schedule to check target wallets. You might give them your keys, but no transfer occurs without your knowledge – here you are lucky because your turn hasn’t come yet 😂🤞🏻
4. If you had things like this, the best and safest approach is simple:
· Long-press the suspicious token in your wallet
· Select "Hide Token" or "Ignore"
· Never interact with it again
🔶️ Therefore, you must always be cautious, monitor approvals, and consider using a keyless wallet like Binance’s keyless option, as it is safer for the user. And pursue continuous learning – direct your curiosity toward subjects and matters you are unfamiliar with, always. 👌🏻
#SAFU🚩 #ScamAlert