Shiba Coin fake distribution on October 12th: “There is no such distribution; this is a scam intende

Be cautious of SHIB airdrop scams: There are hidden traps behind these fake links that can lead to wallet theft.

On Monday, an account on the X platform (formerly Twitter) claimed that SHIB airdroppings were returning, and provided links to check one’s wallet status. Mazrael, a senior member of the Shiba Inu community and advisor for the Shiba Eternity game, immediately identified this post as a scam: “Be careful. There are no such airdroppings. This is a scam designed to steal funds.” Anyone who clicks on those links won’t actually suffer any losses. The real problem lies in the transaction authorization forms that users need to sign—this is exactly what such pages try to trick users into signing up for.

Event review: The incident occurred on October 12th.

The fake account pretended to be an official channel, claiming that a new round of free tokens was being distributed. Anyone who followed the shortened link would be taken to a page that initially only required connecting their wallet. The subsequent window appeared to be a normal transaction confirmation. Mazrael wrote that such posts are common on timelines, and advised users not to click on them, but instead to report the accounts involved. Industry media U.Today reported on this event at 11:25 UTC on October 12th.

There are two key pieces of information missing from this report, both of which affect our understanding of the situation: neither the domain name of the scam site nor the exact amount of losses reported. Therefore, we currently have no information about the number of victims or the amount of tokens stolen. Anyone who reads such reports should verify the sources. What is known for sure is the existence of this incident itself, as well as the warnings issued by the project’s officials.

项目的官方联系点是shib.io。任何真实的官方空投都会在此处及与其关联的频道中发布。仅在X平台上出现且催促紧急操作的所谓“优惠”，在任何技术验证之前都应被视为可疑。

钱包盗取机制：授权如何导致资产流出

钱包盗取程序并非潜入计算机的病毒，而是区块链上的一种智能合约，受害者本人需授权其移动代币。在以太坊标准术语中，这种权限称为“批准”（approval）或“额度”（allowance）。它通过调用approve函数授予，并固定三个细节：哪种代币、接收方是谁、以及金额是多少。

陷阱在于金额。许多界面默认在此处填入最高可能值，以便用户在每次交易时无需再次签名。此类无限额度的批准将持续有效，直到有人撤销它。它不仅涵盖当前的持仓，还涵盖后续到达同一地址的所有SHIB。攻击者无需急于行动，他们可以等待数周，待持仓增长到足够大时再将其转出。

签名与交易：窗口显示的差异

There are two ways of signing transactions, and the wallet displays them with different levels of detail. Transactions incur fees and will be listed in the block explorer later on. In accordance with the EIP-2612 standard, pure signatures (what is referred to as “permits” in practice) require no fees at all, and they are not recorded in your personal history at all. Signatures submitted by attackers, along with the associated fees, are also not recorded. Even if someone has been granted access rights, they won’t notice anything unusual if they only look at the transaction list.

Here’s how to identify this situation: If a page claims to offer free tokens, but requires you to sign documents granting access to your holdings, then it’s likely a scam. A real airdrop would simply send the tokens to your address. It wouldn’t require your permission, since no one needs authorization to send you anything.

The “bait” here refers to the promise of free tokens; the “hook” refers to the underlying authorization process.

Why is Shiba Inu particularly suitable as bait?

Meme coins are ideal for such tactics for two reasons. First, the quantity involved is enormous. According to CoinGecko data, the circulating supply is approximately 589.24 trillion SHIB, while the total supply is 589.50 trillion SHIB. Of the original trillion units, 41.05% have been destroyed or permanently locked away. Anyone who sees such a large amount in their portfolio might easily overlook the true value behind it. Ten thousand SHIB sounds like a lot, but its value was around 47.80 euros on Monday night.

第二个原因是期望。Shiba Inu起源于空投和分发活动，这正是骗子重述的故事。加上价格现状：过去一年下跌49.9%，免费代币的希望是一个有效的杠杆。持仓亏损的时间越长，其所有者越容易寻求能够平衡总和的优惠。

10月12日SHIB价格：0.00000533美元及6300万美元交易量

根据CoinGecko数据，周一晚间SHIB交易价格为0.00000533美元（约合0.00000478欧元）。日内波动范围为0.00000530至0.00000555美元，24小时跌幅为2.6%。一周内下跌9.3%，30天内上涨0.6%，一年内下跌49.9%。市值为31.4亿美元（约合28.1亿欧元），排名第37位。交易量方面，日内换手额为6310万美元。

SHIB距离2021年10月27日创下的历史高点0.00008616美元仍差93.8%。对于此次诈骗而言，这一数字并非注脚：填补这一确切差距正是免费代币优惠所承诺的内容。

昨天，我们在本栏目分析了Shibarium网络利用率在飙升151%后的情况。此后价格进一步下跌2.6%，日内低点0.00000530美元接近当前水平。昨天留下的下方空间标记已成为今日的界线。在这24小时内，链上没有任何变化能解释价格变动。压力来自更广泛的市场，其中比特币和以太坊在一周内也处于下跌状态。

硬件钱包或交易所：托管方式对SHIB安全的影响

This trick only works where you sign your name personally. If your SHIBs are stored in an exchange, then no website on the internet can allow you to grant any approvals, since you don’t have a private key at all. In exchange, you bear the risks associated with being a custodian. Starting from December 30, 2024, providers within the EU must obtain authorization under MiCA regulations to operate this business. However, scam websites never have such authorization. Deposit protection applicable to bank accounts doesn’t apply to cryptocurrencies, even for licensed providers.

If you own your private key, the situation is reversed. No one can freeze your holdings, but every signature you make is your own responsibility. Hardware wallets once again change this dynamic: the private key never leaves the device, and all operations must be confirmed on the device. However, this doesn’t help when it comes to authorizations that require your own consent. If you want to compare devices and their differences, please refer to our article on hardware wallet comparisons.

A viable solution that can withstand such tricks is to separate purposes. One address can be used for everyday, small-scale transactions, while another address can be used to store holdings that remain inactive. By connecting only the first address to external websites, losses can be limited to a small amount, even in the worst-case scenario.

Revoked token approvals are like broken links in a chain: the contract can no longer access those holdings.

How to revoke permissions: how to check your SHIB permissions

Revoking is the only action that can cancel approved transactions. Technically, it allows the amount to be set to zero. However, this involves paying network fees, as it constitutes a transaction and takes effect immediately after being confirmed in the block.

The process is as follows: open the corresponding page of the approval checker or block explorer, such as revoke.cash, and enter your address. The list will show which contracts for each token can transfer a certain amount. Pay special attention to entries with unlimited amounts, as well as contracts whose names are not recognized. Start by setting all these approvals to zero.

There are usually two points that are overlooked. First, the list only covers one chain at a time. SHIB operates on Ethereum, Shibarium, and since early October, it has also been available on Solana in a bridging format. Each chain retains its own approvals. Second, if there are EIP-2612 signatures that have not yet been submitted, they will not disappear from the list. If you suspect that such signatures have been distributed, the only solution is to transfer them to a new address using the new key.

If you still want to consolidate your positions, please check the terms and conditions of the platforms where you hold your tokens: which providers list SHIB, and what the transfer costs are. This will help determine whether it’s worth transferring positions worth several euros.

Stolen SHIB and the tax authorities: holding period, tax benefits, and handling of losses

For German investors, theft presents an unsettling tax aspect. According to Article 23 of the German Income Tax Law, profits from selling crypto assets are considered private dispositions. Profits held for more than one year are tax-free; those held for less than one year are included in other income. Starting from 2024, the annual tax exemption amount is 1,000 euros. If the profit exceeds this limit, it becomes taxable as a whole, not just the excess portion. However, theft does not constitute a sale. Without proper documentation, losses resulting from such dispositions cannot be offset against other private disposal gains, as per the guidelines set by the German Ministry of Finance regarding crypto assets. The loss of ownership means that the tax burden on early gains still remains. Therefore, it’s more reliable to take time to revoke previous approvals rather than attempting any rescue efforts afterward. In any case, the obligation to keep records persists. If SHIB is held in multiple addresses and on the blockchain, clear records of purchase dates must be maintained; otherwise, it will be difficult to prove a one-year holding period during audits. Tools designed to automatically handle this issue can read purchase records directly from addresses. It remains the responsibility of tax advisors to assess individual cases personally. This article does not replace professional advice.

Our assessment: Fakes become more valuable as prices decline

From the perspective of news editors, this occurrence is certainly not a coincidence, particularly given the timing of it within this specific week. The evidence is clear: SHIB has fallen by 93.8% compared to its peak in 2021, with a decline of 49.9% over the past year. A daily trading volume of $63.1 million seems insufficient for an asset with a market value of $3.14 billion. In such circumstances, the promise of free tokens has met with holders who are waiting for a rebound after months of losses. Mazrael also mentioned similar observations in his post, stating that such accounts are becoming too common.

In contrast, the underlying mechanisms remain unchanged. The approval process for these attacks has been in place for many years, and warnings are displayed for each wallet. By reviewing the approval list of addresses quarterly, the basis for such attacks can be eliminated, no matter how convincing the next “solution” may seem. Without any statements regarding future price movements, this section does not constitute any advice on whether to buy or sell.

SHIB safety: Three steps to take before the next approval

Check and revoke the approvals. Go through the list of each address and chain where you hold SHIB, setting unlimited amounts to zero. If your holdings are actually managed by a custodian, check their license details in the cryptocurrency exchange overview.

Separate your holdings. Create one address for daily use, and another address that never connects to external pages. For the second address, it’s reasonable to use devices that use a signature verification method separate from the browser. You can find such devices in hardware wallets.

Record the data related to purchases. Keep track of the date, quantity, and price of each purchase, in order to demonstrate the one-year holding period required by Article 23 of the German Income Tax Law. Appropriate tools for this purpose can be found in cryptocurrency tax software comparison tools.