Someone has created a tx in which my address has supposedly "transferred" 0.00 USDC tokens to another address on Polygon, along with dozens of other addresses also transferring 0.00 DAI/WETH/USDT: https://polygonscan.com/tx/0x5e9ca4a00732d27be81740ccadf2d8758a6d175827a6dfac46578e0e79814484
Judging by the wording, you could've correctly guessed that my private key hasn't been used to sign the tx. Besides, the contract in play didn't have approval for any amount of any tokens issued by my address.
FYI: the DeBank app perceives this tx as an "Approve 0.0000 USDC for 0x2038…e9ba". "Approve" - not "Transfer"...
To make things even more interesting/weirder, the recipient of the 0.00 USDC is somebody I actually know (and with whom I transact from time to time). I can't believe the coincidence...
Having said all that, how is it possible to initiate transfers of tokens (even if the amount is 0.00) from multiple addresses you don't own nor have token approvals from?
Also, why bother doing this? What do they have to gain?
computebudget) to come up with addresses that look like other wallets. But in this case your full wallet address was used, but a look-alike for your friends wallet was used. I can't answer how your wallet was involved in a eth transaction you didn't sign as I don't use eth but I hope that helps.