I have some ETH and ERC20 tokens at an address whose private key is secured by a hardware wallet. I'm confident the private key has not been disclosed to any third party. Yesterday, however, I noticed a couple of strange token withdrawals on July 17 to "DwarfPool_1" as reported by etherscan.io:
The transactions are: https://etherscan.io/tx/0xb3320d2be93ee4a0a4265ab3634db35ad7e2d195caedbc0aac3cea3e73c9fe23 https://etherscan.io/tx/0xd3bafdd9402f2ea939b21a280e7b7c6eaf45db4ba448115759caf5440e711299
The 5000 tokens withdawn are apparantly spam tokens, but ones that I had never received (to my knowledge). The contract name for these tokens includes "tinyurl.com/nicetokens", which when browsed to is a page advertising the services of some ERC20 development group. The page asserts "Your wallet is safe" without providing any details.
My question: how is it possible for a ERC20 token withdrawal to be made from my secure address without my knowledge or approval?? Or is this not a true withdrawal, but something else??
Any clarification would be much appreciated. Thanks!