Case period: Incident analyzed in January 2025. This article is a retrospective review.
The reported attack
Scam Sniffer's 10 January 2025 analysis describes a phishing interaction in which a wallet preview suggested a small incoming ETH payment. The researcher says the contract state was changed between simulation and execution, producing a materially different result when the user signed the claim operation.
What is evidence, and what is interpretation
The report presents the transaction sequence as simulation spoofing. Wallet Beep has reviewed that account but has not independently replayed the transaction. The important distinction is between a prediction based on a particular state and a guarantee enforced when the transaction executes.
A better way to use previews
Read a simulation as one input to the decision. Ask whether the application and contract are expected, whether the request matches your intention and whether the wallet explains any execution-time protection. Refreshing a preview may reduce stale information, but it cannot establish that an unknown claim site is trustworthy. For an incident report, preserve the preview screenshot, time and eventual transaction identifier separately. Keeping those records distinct makes it possible to compare what was displayed with what actually happened, instead of assuming the preview itself was the final result.
Source and review date
Scam Sniffer — original source. Source published: 2025-01-10. Source checked: 2026-10-23.
This is an original Wallet Beep editorial summary. Consult the linked source for its full context and any later updates.