Strange ERC20 "withdrawals" from a secure wallet

Question

I have some ETH and ERC20 tokens at an address whose private key is secured by a hardware wallet. I'm confident the private key has not been disclosed to any third party. Yesterday, however, I noticed a couple of strange token withdrawals on July 17 to "DwarfPool_1" as reported by etherscan.io:

https://etherscan.io/address/0x3f83c1d492AD28A6FD7C9d5e4d5839bd961B1943#tokentxns

The transactions are: https://etherscan.io/tx/0xb3320d2be93ee4a0a4265ab3634db35ad7e2d195caedbc0aac3cea3e73c9fe23 https://etherscan.io/tx/0xd3bafdd9402f2ea939b21a280e7b7c6eaf45db4ba448115759caf5440e711299

The 5000 tokens withdawn are apparantly spam tokens, but ones that I had never received (to my knowledge). The contract name for these tokens includes "tinyurl.com/nicetokens", which when browsed to is a page advertising the services of some ERC20 development group. The page asserts "Your wallet is safe" without providing any details.

My question: how is it possible for a ERC20 token withdrawal to be made from my secure address without my knowledge or approval?? Or is this not a true withdrawal, but something else??

Any clarification would be much appreciated. Thanks!

Answer 1

It's just spam.

An ERC20 token is just a smart contract. The list of "token transactions" you see are just messages logged from ERC20 contracts. If I wrote this contract:

contract SpammyToken {
    // standard Transfer event that all ERC20 tokens emit
    event Transfer(address from, address to, uint256 amount);

    function spam(address who) external {
        emit Transfer(who, 0, 2500);
    }
}

I could call spam whenever I wanted to and cause a "token transaction" to show up for the given account, making it look like 2500 tokens were transferred from them to address 0x0. Nothing of importance actually happened.