Blockchain Transaction Simulation Phishing

• URL: http://arxiv.org/abs/2607.28747v1
• Date: Thu, 30 Jul 2026 18:09:56 GMT
• Title: Blockchain Transaction Simulation Phishing
• Abstract summary: We present the first comprehensive study of transaction simulation phishing.<n>We detect over 4,000 phishing contracts deployed between August 2024 and June 2025.<n>Our analysis identifies more than 5,700 victims and approximately $3.48 million USD in losses, 91.5% of which occurred on clustering.
• Score: 41.25322759036545
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: Cryptocurrency users have increasingly become targets of phishing and scam attacks. To mitigate these threats, leading crypto wallets (e.g., MetaMask) have introduced transaction simulation, which previews a transaction's balance changes before on-chain execution. While effective against traditional fund-draining attacks, we show that this defense can itself be exploited by a new phishing technique, which we term transaction simulation phishing. This attack uses carefully crafted smart contracts whose execution depends on dynamic blockchain state, causing simulations to display benign or profitable outcomes while the actual on-chain execution redirects users' funds to attacker-controlled addresses. We present the first comprehensive study of transaction simulation phishing. We first develop a taxonomy of phishing contracts that can be utilized to facilitate this attack. Then, we propose SIMGUARD, a bytecode-level detection system that combines static and dynamic program analysis to identify phishing contracts. Applying SIMGUARD to Ethereum, Binance Smart Chain, Avalanche, and Polygon, we detect over 4,000 phishing contracts deployed between August 2024 and June 2025. Our analysis identifies more than 5,700 victims and approximately $3.48 million USD in losses, 91.5% of which occurred on Ethereum. Moreover, our clustering result reveals that the largest phishing contract cluster alone accounts for about 83% of the total losses. These results expose a critical weakness in current wallet defenses and highlight the urgent need for more robust transaction simulation mechanisms.

Related papers

• Phishing Detection in Ethereum via Temporal Graph Contrastive Learning [8.217132307053747]
  Existing phishing detection methods primarily rely on graph learning.<n>In this paper, we present PhishEye, a fully dynamic self-supervised system that monitors on-chain transactions to detect phishing activities.<n>The evaluation on a dataset of 161,658 addresses and 416,541 transactions shows that PhishEye outperforms existing methods.
  arXiv  Detail & Related papers  (2026-05-02T02:53:53Z)
• One Token Embedding Is Enough to Deadlock Your Large Reasoning Model [91.48868589442837]
  We present the Deadlock Attack, a resource exhaustion method that hijacks an LRM's generative control flow.<n>Our method achieves a 100% attack success rate across four advanced LRMs.
  arXiv  Detail & Related papers  (2025-10-12T07:42:57Z)
• Decompiling Smart Contracts with a Large Language Model [51.49197239479266]
  Despite Etherscan's 78,047,845 smart contracts deployed on (as of May 26, 2025), a mere 767,520 ( 1%) are open source.<n>This opacity necessitates the automated semantic analysis of on-chain smart contract bytecode.<n>We introduce a pioneering decompilation pipeline that transforms bytecode into human-readable and semantically faithful Solidity code.
  arXiv  Detail & Related papers  (2025-06-24T13:42:59Z)
• PhishingHook: Catching Phishing Ethereum Smart Contracts leveraging EVM Opcodes [2.427531959511691]
  PhishingHook is a framework that applies machine learning techniques to detect phishing activities in smart contracts.<n>We experimentally compare 16 techniques, belonging to four main categories (Histogram Similaritys, Vision Models, Language Models and Vulnerability Detection Models) using 7,000 real-world malware smart contracts.<n>Our results demonstrate the efficiency of PhishingHook in performing phishing classification systems, with about 90% average accuracy among all the models.
  arXiv  Detail & Related papers  (2025-06-24T10:16:47Z)
• Blockchain Address Poisoning [5.68371809302547]
  In many blockchains, users often select addresses from their recent transaction history, which enables blockchain address poisoning.<n>The adversary generates lookalike addresses similar to one with which the victim has previously interacted, and then engages with the victim to poison'' their transaction history.<n>We identify 13times more attack attempts than reported previously -- totaling 270M on-chain attacks targeting 17M victims.
  arXiv  Detail & Related papers  (2025-01-28T03:34:59Z)
• Dissecting Payload-based Transaction Phishing on Ethereum [13.398858969125495]
  payload-based transaction phishing (PTXPHISH) manipulates smart contract interactions through the execution of malicious payloads to deceive users. PTXPHISH has rapidly emerged as a significant threat, leading to incidents that caused losses exceeding $70 million in 2023 reports. We establish the first ground-truth PTXPHISH dataset, consisting of 5,000 phishing transactions. We propose a rule-based multi-dimensional detection approach to identify PTXPHISH, achieving over 99% accuracy in the ground-truth dataset.
  arXiv  Detail & Related papers  (2024-09-04T02:26:59Z)
• Blockchain Amplification Attack [13.13413794919346]
  We show that an attacker can amplify network traffic at modified nodes by a factor of 3,600, and cause economic damages of approximately 13,800 times the amount needed to carry out the attack.<n>Despite these risks, aggressive latency reduction may still be profitable enough for various providers to justify the existence of modified nodes.
  arXiv  Detail & Related papers  (2024-08-02T18:06:33Z)
• Vulnerability Scanners for Ethereum Smart Contracts: A Large-Scale Study [44.25093111430751]
  In 2023 alone, such vulnerabilities led to substantial financial losses exceeding a billion of US dollars. Various tools have been developed to detect and mitigate vulnerabilities in smart contracts. This study investigates the gap between the effectiveness of existing security scanners and the vulnerabilities that still persist in practice.
  arXiv  Detail & Related papers  (2023-12-27T11:26:26Z)
• Blockchain Large Language Models [65.7726590159576]
  This paper presents a dynamic, real-time approach to detecting anomalous blockchain transactions. The proposed tool, BlockGPT, generates tracing representations of blockchain activity and trains from scratch a large language model to act as a real-time Intrusion Detection System.
  arXiv  Detail & Related papers  (2023-04-25T11:56:18Z)
• Token Spammers, Rug Pulls, and SniperBots: An Analysis of the Ecosystem of Tokens in Ethereum and in the Binance Smart Chain (BNB) [50.888293380932616]
  We study the ecosystem of the tokens and liquidity pools. We find that about 60% of tokens are active for less than one day. We estimate that 1-day rug pulls generated $240 million in profits.
  arXiv  Detail & Related papers  (2022-06-16T14:20:19Z)
• Quantum Multi-Solution Bernoulli Search with Applications to Bitcoin's Post-Quantum Security [67.06003361150228]
  A proof of work (PoW) is an important cryptographic construct enabling a party to convince others that they invested some effort in solving a computational task. In this work, we examine the hardness of finding such chain of PoWs against quantum strategies. We prove that the chain of PoWs problem reduces to a problem we call multi-solution Bernoulli search, for which we establish its quantum query complexity.
  arXiv  Detail & Related papers  (2020-12-30T18:03:56Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.