Analysis of the “0 amount transfer” phishing scam on the chain

​
​Case description
​
​
In a typical attack scenario, after user A initiates a normal asset transfer (such as 500 USDC) to address B, two abnormal 0-amount transfers will appear in the transaction record: one is a transfer of 0 USDC from attacker C to user A, and the other is a transfer of 0 USDC from user A's address to attacker C without his own operation.
​
​
​
​
​
​
​Analysis of technical principles
​
​
This type of scam takes advantage of the characteristics of the transferFrom function in the smart contracts of some mainstream tokens (such as USDT, USDC).
​
​
The attacker monitors active addresses on the chain through automated scripts and triggers the function in a targeted manner to generate false transfer records.
​
​
​
​
​
​
​Prevention and response measures
​
​
Users do not need to panic when faced with such 0-amount transfer records. This does not mean that your private key has been leaked or the security of your wallet has been compromised.
​
​
​Ignore abnormal records: Please ignore any 0-amount transactions that are not initiated by you.
​
​
​Multi-check address: Before transferring assets, be sure to completely check every character of the target address, not just the first and last digits.
​
​
​Small-amount test verification: Before making a large-amount transfer, it is recommended to initiate a small-amount transaction to verify the address validity.