Researchers have identified 4,224 malicious smart contracts that tricked victims into signing away their crypto, causing roughly $3.48 million in historical losses across 5,742 addresses. The contracts were found on Ethereum, BNB Smart Chain, Avalanche, and Polygon. Ethereum took the brunt — 91.5% of the losses happened there.
The SimGuard detector
The study used a contract-bytecode detector called SimGuard to flag the malicious contracts. The tool scans for patterns that exploit transaction simulation: a preview shows a small gain, but the actual transaction sends the deposit to an attacker. The researchers identified three attack variants — storage-control, timestamp-based, and gas-control — all designed to hide the real outcome until it's too late.
How the scams work
Victims see a simulation that looks profitable. They sign, and the contract executes differently. The paper cites a Jan. 8, 2025 Etherscan transaction where a Claim() call moved about 143.45 ETH through a contract labeled as phishing. That's a single example of the scale these attacks can reach.
Caveats and inconsistencies
The findings haven't been peer-reviewed. The paper itself has some rough edges — inconsistent figures for its Avalanche contract count and conflicting endpoints for the attack window. The detector evaluation covered only 44 contracts, including 30 generated with Gemini, and the code repository returned a 401 error when checked. So the tool isn't publicly verifiable yet.
What users can do
The study recommends re-running simulations when contract state or gas fields change, using actual gas parameters, and testing different block numbers and timestamps. A practical UI suggestion: show the gross amount leaving a wallet alongside the net balance change. That way a negligible refund doesn't get mistaken for profit. Until wallets adopt that, the burden stays on users to double-check what they're signing.
The next step is peer review. Until then, the 4,224 contracts are a warning — but not a complete map of the threat.
