Blockchain Transaction Simulation Phishing

2026-07-30

AI Summary

This work addresses a critical vulnerability in existing cryptocurrency wallets, where transaction simulation features can be bypassed by a novel class of phishing attacks, leading to substantial user asset losses. The paper formally defines, for the first time, “transaction simulation phishing attacks,” elucidating how adversaries exploit dynamic state discrepancies in smart contracts to deceive preview mechanisms. To counter this threat, the authors propose SIMGUARD, a bytecode-level hybrid detection approach combining static and dynamic analysis. Evaluated across four major blockchains, SIMGUARD identified over 4,000 malicious contracts, confirmed more than 5,700 victims, and uncovered approximately $3.48 million in financial losses—83% of which stemmed from a single contract cluster—demonstrating a significant advance in defending against these stealthy attacks.

Abstract

Cryptocurrency users have increasingly become targets of phishing and scam attacks. To mitigate these threats, leading crypto wallets (e.g., MetaMask) have introduced transaction simulation, which previews a transaction's balance changes before on-chain execution. While effective against traditional fund-draining attacks, we show that this defense can itself be exploited by a new phishing technique, which we term transaction simulation phishing. This attack uses carefully crafted smart contracts whose execution depends on dynamic blockchain state, causing simulations to display benign or profitable outcomes while the actual on-chain execution redirects users' funds to attacker-controlled addresses. We present the first comprehensive study of transaction simulation phishing. We first develop a taxonomy of phishing contracts that can be utilized to facilitate this attack. Then, we propose SIMGUARD, a bytecode-level detection system that combines static and dynamic program analysis to identify phishing contracts. Applying SIMGUARD to Ethereum, Binance Smart Chain, Avalanche, and Polygon, we detect over 4,000 phishing contracts deployed between August 2024 and June 2025. Our analysis identifies more than 5,700 victims and approximately $3.48 million USD in losses, 91.5% of which occurred on Ethereum. Moreover, our clustering result reveals that the largest phishing contract cluster alone accounts for about 83% of the total losses. These results expose a critical weakness in current wallet defenses and highlight the urgent need for more robust transaction simulation mechanisms.

Problem

• transaction simulation phishing
• blockchain phishing
• smart contract security
• crypto wallet defense
• deceptive transaction preview

Innovation

• transaction simulation phishing
• SIMGUARD
• smart contract security
• blockchain phishing detection
• bytecode-level analysis