When a transaction simulation shows you will receive tokens, your wallet might actually be showing you a phishing link. In July 2026, a research paper (arXiv:2607.28747) counted over 4,000 phishing contracts that exploited transaction simulation flaws between August 2024 and June 2025. These scams caused at least 5,700 victims to lose more than $3.48 million. When your wallet tells you "you will receive 0.000...0001 ETH," attackers are using the few seconds between simulation and execution to change the contract state into a version that drains your wallet.
Step 1: Know the Difference Between "Safe Simulation" and "Safe Transaction"
What to do: Understand what the simulation's "safe" result actually covers.
How to do it: A wallet's transaction simulation previews your transaction based on the current on-chain state before you sign. It shows expected balance changes. What it can do:
Detect if the transaction directly transfers your assets (such as ETH or USDT).
Show gas fees and expected balance changes.
What it cannot do:
Predict changes in the contract's state between simulation and execution. Attackers exploit this time gap. During simulation, it shows "you will receive ETH." The moment you sign, the contract state is altered, and the actual execution becomes "send your assets to the attacker."
Completion standard: You can clearly separate "the simulation shows no risk" from "the transaction itself is risk-free." These are two different things.
Step 2: Spot the Key Signs of a Simulation Phishing Scam
What to do: Before signing, identify if the transaction might come from a phishing contract that manipulates simulations.
How to do it: The research sorts phishing contracts into six types. The core feature is that the contract's execution result depends on dynamic on-chain conditions (like block number, timestamp, or gas price). This makes the simulation and the real execution follow two completely different paths. In practice, watch for these red flags:
"Claim" or "Reward" pages from unknown sources: The page claims you can get free ETH, tokens, or airdrops, but there is no social verification from an official project.
The word "Free": Phishing sites almost always use "free claim" to lower your guard. A documented security case shows one user lost 143.45 ETH (about $460,000) in a single simulation phishing attack.
Wallet shows a very tiny received amount: Attackers deliberately set the simulated received amount to 0.000...0001 ETH, making you think, "It's just a few cents, I'll sign and see."
High risk: Even if the simulation shows you "receiving" tokens, this can be an illusion. Attackers can use fake transaction IDs and forged on-chain records to simulate a deposit. Their only goal is to trick you into believing the transaction is safe, so you sign the signature that really drains your wallet.
Completion standard: You can judge whether the website you are interacting with falls into the "free claim" category and has not been verified through official project channels.
Step 3: Follow a Security Process That Does Not Rely on Simulation
What to do: Handle transactions using a set of safety steps that do not depend on simulation results.
How to do it:
Only trust verified DApps: Before connecting your wallet, check the project's official website and social accounts (X, Discord) to confirm the link is genuine. Do not click random links in search results.
Independently verify the transaction content: Do not only look at the wallet's simulation screen. Before signing, use a block explorer (Etherscan/BscScan) to check if the contract address you are interacting with has been flagged, or has warning tags like "Renounced Ownership" or "Honeypot."
Understand whether you are signing an "approval" or a "transfer": Many phishing attacks trick you into signing an ERC-20 approve function, not a direct transfer. Once you grant approval to a malicious contract, it can move your tokens at any time later. The simulation showing "receive tokens" and "you approved unlimited allowance" can happen at the same time. There is no conflict between them.
Use a hardware wallet for large transactions: A hardware wallet's confirmation process and signing logic are physically separated from hot wallets. Even if you click "connect" on a phishing site, it cannot directly extract your assets.
How to verify after the transaction: After the transaction completes, do not rely on the wallet's balance display. Go directly to a block explorer and check your wallet address. Confirm that the actual asset change matches your expectation. If the explorer shows assets decreased while the wallet simulation showed you "receiving" them, you have encountered a simulation phishing scam.
