I have some ETH and ERC20 tokens at an address whose private key is secured by a hardware wallet. I'm confident the private key has not been disclosed to any third party. Yesterday, however, I noticed a couple of strange token withdrawals on July 17 to "DwarfPool_1" as reported by etherscan.io:


The transactions are: https://etherscan.io/tx/0xb3320d2be93ee4a0a4265ab3634db35ad7e2d195caedbc0aac3cea3e73c9fe23 https://etherscan.io/tx/0xd3bafdd9402f2ea939b21a280e7b7c6eaf45db4ba448115759caf5440e711299

The 5000 tokens withdawn are apparantly spam tokens, but ones that I had never received (to my knowledge). The contract name for these tokens includes "tinyurl.com/nicetokens", which when browsed to is a page advertising the services of some ERC20 development group. The page asserts "Your wallet is safe" without providing any details.

My question: how is it possible for a ERC20 token withdrawal to be made from my secure address without my knowledge or approval?? Or is this not a true withdrawal, but something else??

Any clarification would be much appreciated. Thanks!

1 Answer 1


It's just spam.

An ERC20 token is just a smart contract. The list of "token transactions" you see are just messages logged from ERC20 contracts. If I wrote this contract:

contract SpammyToken {
    // standard Transfer event that all ERC20 tokens emit
    event Transfer(address from, address to, uint256 amount);

    function spam(address who) external {
        emit Transfer(who, 0, 2500);

I could call spam whenever I wanted to and cause a "token transaction" to show up for the given account, making it look like 2500 tokens were transferred from them to address 0x0. Nothing of importance actually happened.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.