Be aware of “0 USDT” transfer scam.

3 min readNov 28, 2022

As we all know, Malicious Approval is to approve some amount of tokens to be invoked by the contract, but most of the malicious approvals will invoke all your token balance.

But, is it possible to invoke the assets of a normal wallet address that didn’t approve before?

Recently, many users found out there is a “0 USDT” transaction history appearing in the wallet. For example,

The first time you saw this transaction, you might think you were struggling with the risk of risky approval, then you might check on the blockchain explorer.

However, only “Cancelled” is shown on the blockchain explorer.

And you can’t find any approval history in the Approval Change History.

So, what’s going on? Let me explain further.

Take TRONSCAN as an example, find the USDT contract address, and click [Contract] — [Write Contract] — [8. transferfrom].

You can enter [_from_address], [_to_address_], and the [_value], then click [Send]. [true] means the operation is successful. This is a simple invoke operation, which will cause your wallet [Approval] to add a history that shows “Cancelled” and also, through this invokes, it will cause “0 USDT” transfer history to appear in your wallet.

Scammers want to trick you into copying the wrong address during the transfer process, which can lead to the loss of assets. Be aware of the phishing address!

Q&A

Why my asset can be invoked?

This operation is performed directly through the TransferFrom function of the USDT, any address can be invoked and generate a transfer record in the wallet and a “Cancelled” record in the Approvals. By the way, please note that this situation may occur in all public chains including EVM-based chains, TRON, etc.

Are my assets still safe?

The purpose of this operation is to simulate the transaction from the user’s address, combined with the disguised address to induce the user to misoperate the transfer, it won’t affect your asset's security, but please be aware of this possible misoperation execution.

TokenPocket Security Measure

You can hide these small transaction records to stay away from phishing transfer scams!

👉Use Guide

About TokenPocket

TokenPocket is the world’s leading multi-chain self-custodial wallet, which supports mainstream public chains including BTC, ETH, BSC, TRON, Polygon, Solana, HECO, Klaytn, Avalanche, OKC, HSC, Fantom, Polkadot, Kusama, etc. The trinity of TokenPocket mobile wallet, chrome extension wallet, and hardware wallet has been formally formed. The Secret Recovery Phrase and Private Key are stored in the user’s own device and the user can fully control his own crypto assets. TokenPocket has provided reliable services for over 20 million users around the world. The number of monthly active users exceeds 3.5 million and the users are located in more than 200 countries around the world.