Zero Transfer Scam is the new tactics bad actors are using to compromise wallets and swindle users. Scams in the cryptocurrency space are changing daily and scammers are becoming more innovative. Hence, the aim of this article is to educate you on the new scam at the moment called Zero transfer Scam and give you possible ways to stay safe.
What is Zero Transfer Scam?
Zero Transfer Scam is a type of scam that targets users on the Tron and Ethereum Virtual Machine (EVM) chains. In a Zero Transfer Scam, the fraudster transfers 0 tokens from any user’s wallet via the “TransferFrom” function, causing the 0 transfer to appear in the user’s wallet history. The fake history can lead you to use the scammer’s address and risk your money.
How Zero Transfer Victims were attacked
The victims of the Zero Transfer Scam received 0 USDT from unrecognized addresses severally. This was seen on the transaction history of TRON network users and though it is paramount in the TRON network, the scenario could be replicated in the Ethereum network.
The scammers used the “Transfer From” function to make a transfer of 0 tokens from any user’s wallet. This created a fake wallet history with 0 transfers. The “Transfer From” function allows any user’s account to transfer 0 to an unauthorized account without the transaction failing.
According to the CEO of SafePal, Veronica @V_SafePal “This scam is targeting EVM chains and the Tron network. Scammers utilize the ‘Transfer_From’ feature to conduct 0 transfers from any wallet address via the help of a smart contract, thus making the 0 transfer show up in users’ wallet records”.
Hence, as an innocent user, you may use the scam address for blockchain transfers without carefully checking it. This is possible because Zero Transfer scammers create fake wallet addresses that are similar to users’ real wallet addresses. Hence, your wallet could be compromised and scammed if you use the scammer’s address.
What is the Ethereum Virtual Machine?
The Ethereum Virtual Machine, EVM is a virtual decentralized CPU used by Ethereum to demonstrate the speed of smart contracts. Hence, majority of current blockchains are powered by the Ethereum Virtual Machine (EVM). The EVM can be regarded as the component of Ethereum that carries out the deployment of smart contracts.
EVM extends blockchain technology’s ability to interpret contracts impartially. The EVM’s efficiency and compatibility with the Ethereum ecosystem are two of its elegance and beauty. Without the EVM, compilers specific to each operating system would need to be created by blockchain programmers and developers.
Blockchains with compatible EVM indicates that the code was written to operate and carry out smart contracts in accordance with the EVM requirements. Hence, many blockchains strive towards EVM compatibility so as to make the transition from Ethereum to their blockchain as simple as possible. Some examples of EVM compatible blockchains are: Binance Smart Chain, Polygon, Cronos, Solana, Tron.
Hence to explain the occurrence of Zero Transfer Scams on Tron, developers may simply convert their DApps from Ethereum or other EVM-compatible blockchains to TRON because TRON’s virtual machine is compatible with the Ethereum Virtual Machine (EVM).
Case Studies of Zero Transfer Scams
According to a user on Reddit, with username, CryptoCliffs, he observed that 0 USDT came in and then went out from his personal wallet.
He also went ahead to share the transaction hash of this transaction and the explorer details can be shown below:
Also, in an article by Slowmist, the author analyzed how the Zero Transfer Scam works. Unavoidably, as a user, you may worry that your wallet has been compromised if you find a transaction record that is not your own or that when you try to change or re-download your wallet, you incur the risk of being scammed and robbed. In contrast, if an attacker “hijacks” your transaction history, you run the risk of losing your money by copying the wrong transfer address.
How the Zero Scam Hackers Operate
The Zero Scam is an on-chain attack but users’ assets are still safe and the private key is not leaked. To carry out this attack, The hacker;
i. Monitors the transfer information on the chain and takes note of the victim’s transaction address of user “A” and user “B”.
ii. The hacker then constructs a fake address “C” with the same first and last digits as user “B” so that user “A” will unknowingly transfer to user’ ‘C” which is the hacker’s address.
iii. User “A”, who is the victim, copies the fake address of the hacker, thinking it is the address of user “B”, and when the funds are transferred, it is lost.
The above is possible because the hacker has altered the victim’s transaction history, by adding a fake address to the history. The victim will think the address is genuine.
Staying Safe From Zero Transfer Scams
To maintain safety, users should apply caution and confirm addresses before initiating a transaction.
As a cryptocurrency wallet user, double-check your addresses before executing any activity.
Safepal has also modified the length of the wallet address shown in the transaction history in their most recent V3.7.3 version. To facilitate address inspection, the first and final 10 digits of the wallet address is being displayed by default.
Also, some wallet users can adjust the length of the wallet addresses in the transaction history by filtering and hiding the 0 transfer on EVM chains and TRON on the wallet.
Atomic Wallet also released a new update on their website. So as a user, if you encounter an error message “FAILED – OUT OF ENERGY” and you think it might be related to the “Zero Transfer Scam,” just update your wallet.
When downloading a crypto wallet app or visiting any website, apply caution. Make sure to confirm that it is the real wallet.
Avoid saving passwords or private wallet keys on Google Sheets, Excel, or Notepad. If necessary, check for trustworthy password management programs.
Utilize 2FA for your cryptocurrency accounts and always use strong passwords.
A&D Forensics Can Help You
At A&D Forensics, we have received cases and reports from Zero Transfer Scam Victims. Hence, we have decided to educate our community through this article. Do well to adhere to the safety measures shared above to avoid becoming a victim.
Zero Scam Victims can also send us a report of their cases for a possible investigation by the A&D Forensics investigation team. To send a report to the investigation team, open a case here.
Contact our compliance experts to help you integrate compliance into your VASPs and Web 3 Start-Ups, to avoid cryptocurrency hacks or similar attacks on your platforms. Lastly Subscribe to our blog and newsletters for more information on cryptocurrency and blockchain scams.
Contributor: Emmanuel Bassey
