MXC international station is a platform focusing on the exchange and exchange of blockchain assets, which was founded by the senior quantitative trading team of Wall Street, Japan and Europe and senior practitioners of blockchain through decentralized self-organization. MXC will provide users with more secure, convenient and intelligent blockchain asset circulation services, aggregate global high-quality blockchain assets, integrate the world's top security technology, and strive to build a world-class blockchain asset international station.

Download tokenpocket wallet (official website: https://www.tokenpocket.pro ）TP wallet, also known as TP wallet, supports a variety of cross chains. At present, it is a wallet with a relatively high share, and the operation is simple and convenient.
It can directly import bitcoin, Ethereum, EOS, wave field, fire coin heco, coin security BSC, Boca, KSM, okex chain, Iost and other main chain wallets.
Note: at present, Shib is issued in the main chain of Ethereum and can only be withdrawn to Ethereum wallet.
At the same time, ETH is required for wallet transfer as a handling fee. It is recommended that you prepare 0.1 eth for subsequent transfer or participation in activities.
Simple five step coin withdrawal Shib to personal wallet (take the coin withdrawal of Matcha exchange as an example)
The first step is to create or import Ethereum wallet
If you don't have an Ethereum wallet, you must save the private key and mnemonic words when creating a wallet, which is similar to the various password forms of your bank card.
After saving, any Ethereum wallet can retrieve your assets as long as there is an Internet. Remember to keep the private key / mnemonic words and never send them to anyone.
It is recommended to save the private key and mnemonic words (it is recommended to save them in combination):
1. Copy it on paper and put it in an absolutely safe place
2. Backup encryption with USB flash disk
3. Compressed encrypted network disk save
4. At the same time, back up a copy to your family
Managing your wallet is the first step in asset management!
Remember to save in multiple ways.
After downloading the TP wallet, you need to create an Ethereum wallet and save the private key and mnemonics.
After creation, if you have an Ethereum wallet, you can click to import your own Ethereum wallet, and enter a mnemonic or private key to restore the wallet.
Step 2: on the asset page, click ➕  No., add Shib asset
It is recommended to search Shib smart contract address and add it. Each Ethereum token has a unique smart contract address.
Shib smart contract:
0x95ad61b0a150d79219dcf64e1e6cc01f0b64c4ce produced by Lingmao Business School
After searching, click the "+" sign on the right to add assets
Step 3: after adding successfully, return to the wallet, click the Shib details page, click collection, and obtain the collection address and collection QR code,
Step 4: open the exchange, enter the asset page, find Shib, click the details page, and click [withdrawal]. Take Matcha exchange as an example:
Step 5: enter the quantity according to the prompt, paste the wallet address, or identify the QR code, and click [OK]
Note: be sure, be sure to repeatedly confirm that the wallet transfer address is consistent with the coin withdrawal address. After confirmation, click OK.
Note: it is suggested that if the number of shibs is large, you can withdraw money with a small amount of money first, and then withdraw all assets after no problem.
After the successful withdrawal, the arrival time depends on the congestion of Ethereum network. After the successful withdrawal, Shib will automatically transfer to your wallet, and you can go to Ethereum wallet to check the details.
The whole process is completed. Congratulations, your Shib really belongs to your assets. Congratulations on the success of coin withdrawal.

1. There are only Eth and erc20 chains on the ETH chain, but only those on the BSC chain can be received on the BSC chain. It cannot be directly transferred to how to operate. It can be cashed directly in the wallet, and the handling fee is relatively high; You can also switch from the wallet to the platform and then to the wallet to toss it again. TP wallet to eth is transferred to the exchange through erc20 channel, and then transferred from the BSC chain of the exchange to eth to the BSC chain of TP wallet. Although the steps and handling charges are increased, it is cheaper than flash cash.

2. The first time the newcomers operate, they really can't figure out why different chains and chains of different platforms in the wallet can't be transferred directly. It's because the blockchain is decentralized. There is no manual audit before each transaction, and the program only takes relevant steps according to the transaction initiation. Therefore, even if the address is wrong and the coin is lost, the miner's fee should also be paid. Any activity on the chain requires miner's fee.
3. Although there are many channels for digital wallet, there is basically no problem as long as we understand the corresponding chain between transfers. If there is no same chain between different chains, we need to find a third-party springboard to ensure that the link is clear.
1. Blockchain and blockchain wallet have developed for more than 10 years, which has roughly experienced three periods. During blockchain 1.0, people's demand for wallet is more about all node wallet mining and BTC and other assets management. In the ETH blockchain 2.0 era, blockchain wallets need to manage various types of tokens and interact with smart contracts. At this time, light wallets that do not need to synchronize all nodes have become our first choice, such as metamask. In blockchain 3.0, with the development of the public chain, the function and complexity of the wallet are gradually increasing. It is not limited to the storage and management of assets, but also serves as the most important ecological service platform of the whole public chain. At the same time, there are more and more scenes for people to interact with the blockchain anytime and anywhere, and mobile wallet has become your first choice. So far, more and more public chain wallets were born, including wave field wallets.
2. Wave field (Tron) has always been a hot project of domestic public chain. With the continuous optimization and improvement of the main network of wave field, the transaction speed per second (TPS) of wave field public chain has been increased to 10000, and the performance of public chain has been continuously improved, which has mobilized the enthusiasm of ecological participants to a greater extent. Wave field (Tron) has developed very rapidly in the past two years. With its advantages of low development and use cost and superior transaction performance, wave field has attracted many users and developers. The number of users and transactions of wave field DAPP has always ranked among the top three in the public chain.

1. Download token pocket:

https://www.tokenpocket.pro/
2. Create Wallet
*For new users registered for the first time, click [I don't have wallet] and select [Huo coin ecological chain] to create it. Users who have wallets to import can choose [I have wallet].
*Back up mnemonics, select mnemonics in order on the verification page and confirm.
3. After creation, go back to the wallet address of Huo coin ecological chain, click "+" to add tokens. Or enter token or contract address above to search.
4. Click [discovery] at the bottom of the home page and enter solo at the top of the discovery page Top click [go to DAPP] to enter.
5. Select the corresponding asset from the drop-down list and click authorize.
Click [confirm payment] and note that a small amount of HT is required as the handling fee.
6. Deposit, withdraw and withdraw income

1、 How to download Wallet

1. Open the official website of TP wallet www.tokenpocket.com Pro select the mobile phone to download and install.
2. Apple users support app store Version (overseas ID required) and testflight version. The tutorial takes testflight version as an example:
2、 How to create a wallet
1. After downloading the TP wallet and opening the installation, the new user registered for the first time clicks [I don't have a wallet] and selects [heco (fire coin ecological chain)]. For users who already need to import wallets, you can choose [I have wallets]. The following tutorials have not registered wallets by default.
2. Click [create wallet] to enter the creation interface. After setting [wallet name] [password], click Create wallet to enter the prompt interface of backup wallet, and carefully read the precautions.
3. The [backup mnemonic] interface requires us to record the mnemonic words correctly according to the mnemonic words and order provided. After confirming the record, click [backup completed for verification] to complete the mnemonic verification in the correct order. After completing mnemonic verification, you can register successfully.
4. Just click the [discovery] menu at the bottom to use the DAPP of the subsequent fire coin ecological chain. (a large number of dapps are on the road) for the safety of your assets, it is recommended to try to choose the DAPP on the shelf wallet when choosing DAPP, and be careful not to encounter some high-risk DAPP projects.
3、 How do I transfer my wallet
1. Select the token to be operated (such as HT), click transfer in the lower left corner, and click the collection function to obtain the collection QR code and copy the collection address. Users who use TP wallet can directly scan the code for payment. (if encountering QR codes of other platforms, there may be compatibility. At this time, it is best to use the copy and paste function)
2. There are three transfer methods: direct transfer, address book transfer and code scanning transfer. We can choose according to our customary methods. Please fill in the transfer interface carefully and check whether the collection address and transfer out quantity are correct; Three kinds of miner fees can be selected in the miner fee area, and can also be customized; [advanced function] you can enter [text] or [hex] and send the uplink.
4、 How to back up mnemonics and private keys
Open the wallet and click the [details] function in the upper right corner of the upper blue area to enter the wallet details. You can select [export mnemonic], [export private key], [export keystore], and users can choose one or more backups according to their actual situation. (no matter which backup method is adopted, it must be kept well and not lost or disclosed)
5、 Mnemonic and private key import into Wallet
1. When using TP wallet, old users can open the wallet after installation, select [I have wallet], select coin security smart chain, and import it by mnemonic, private key, etc; Users who have used tp wallet can select the function of importing wallet by opening the first item [add wallet] in the upper right corner of the wallet.
2. Select a suitable import method (such as private key import), just fill in your own private key, set the password, and then click the [import wallet] function to import and manage the wallet. (decentralized wallet, mnemonics, private keys, etc. are the only vouchers imported and managed, so please be sure not to

It should be OK. You find it in the TP wallet. Open uniswap and you can change it to usdt, but you need to pay eth. You need to buy some eth.
If you want to buy money, you can refer to the following steps:
1. Download TP - create wallets with different chains, such as heco chain, BSC chain, ETH chain and so on. Remember mnemonic words. If you forget mnemonic words, you may not find the information in the wallet
2. In the tp- market, you can find some popular token exchange information. You can understand the basic situation of these contracts and judge whether they can be invested. You can also track for a period of time to understand the specific situation and then try trading.
3. You can also find the contract address of new currency in other ways to understand the basic situation. After finding the address of the new token contract, learn which chain it is, the number and information of coins held, and pay attention to the holding.

1. TP wallet has been created successfully. There is no coin in the wallet and it needs to be charged.

2. Add usdt token.
Usdt is universal, and the general price changes little, referred to as U.
3. Obtain usdt collection address.
This is your TP wallet collection address. If others transfer money to this address, you can receive it.
Copy this address. This is heco's wallet address. It can only accept the currency transferred from fire B exchange, and fire B exchange should choose heco chain when transferring out.
If you enter the wrong address, the coin will be lost and can't be found.
After you have the wallet address, if you need someone to charge you money, or if you have money in other exchanges, you can go here.
4. Withdraw money from the exchange to TP wallet.
On the app asset withdrawal page
5. Withdrawal steps:
1. Select the currency to be withdrawn, generally usdt;
2. The TP wallet mentioned from the exchange chooses heco. If it refers to other chains, pay attention to the choice. If the chain is wrong, the currency may be lost;
3. The withdrawal address is the collection address of TP wallet obtained in step 3. Be sure to check that the input is accurate.
4. Enter the quantity of currency withdrawal;
5. Handling charges will be incurred for each operation;
6. Withdraw the currency and output the password and verification code according to the prompt
6. Generally, it takes 1-3 minutes to recharge.
Sometimes the system with many people will be more stuck and take longer.
You can view the details of currency withdrawal in the upper right corner of currency withdrawal. You can know the operation steps by viewing the status.
If the operation is wrong, contact the platform customer service at the first time and send the operation details to the customer service for viewing, so as to recover the loss as much as possible.
7. Check the receipt in TP wallet.
Find the usdt token and check the transfer in.
8. Transfer in HT token.
When you buy money in TP wallet, you need to pay the miner's fee.
If you cannot buy new currency without corresponding currency, you can transfer 2 HT and 0.2 BNB.
HT is required on the heco chain and BNB is required on the BSC chain.
1. Select HT token in TP wallet;
2. Obtain HT token collection address and copy HT collection address;
Note: when the token chain is opened in heht, select the token chain
4. Enter the HT token address obtained from TP wallet and recharge.
5. Go back to TP wallet to check the receipt.
TP wallet can buy new currency after it has currency. Pay attention to the risk of new currency and be within its own tolerance. present

What is the coin security smart chain

Coin security smart chain (BSC), as a blockchain running in parallel with coin security chain, is compatible with the existing Ethereum ecosystem and is an optimized version of Ethereum system.
BSC is a blockchain compatible with Ethereum virtual machine. It is the testing and frontier exploration of top projects in the encryption asset industry. The launch of BSC will greatly improve the use efficiency and application scope of coin safety chain and BNB. By introducing the POSA consensus mechanism, BSC has created an ecosystem that allows nodes, token holders, developers and users to benefit from the blockchain and enjoy higher performance and more innovation space.
It will become a bridge between various public chains
The "token canal" plan of coin an intelligent chain can connect coin an intelligent chain with other public chains. If the public chains are parallel highways, coin an will become a bridge between grafted highways.
Through the secure hosting service of coin security cefi platform, tokens on other public chains can be bridged to coin security intelligent chain, including BTC of bitcoin, erc20 (ETH, link, usdt, Dai, etc.), XRP, BCH, LTC, ADA, dot, xtz, EOS, ont, etc. Through bridging, the coin security intelligent chain will be able to realize the one click transfer of assets between different network tokens. Users can simply and quickly transfer token assets into the coin security intelligent chain, and can also reverse conversion at the same time.
Decentralized governance, BNB users get the governance right on the chain
The consensus mechanism adopted by coin security intelligent chain is proof of authority (POSA), which combines the functions of entrusted proof of interest (dpos) and proof of authority (POA). The consensus mechanism algorithm is based on the network of 21 verification nodes, and the second block out time can establish a high-speed infrastructure for the defi protocol.
At the same time, the verification node can obtain BNB reward through its workload on the blockchain, which ensures the stability and incentive while ensuring the transaction speed.
The new version of TP is released and fully supports the coin security smart chain
Support the creation of coin security smart Chain Wallet
After installing the latest version of wallet, new users can directly click [I don't have wallet] and select coin security smart chain to create it. (old users can click [I have wallet] and import it with mnemonic words or private key)
640? wx_ fmt=jpeg&tp=webp&wxfrom=5&wx_ lazy=1&wx_ co=1
Click the "create" wallet button, and then enter the wallet name and password successively. After entering, click the "create wallet" button below.
640? wx_ fmt=jpeg&tp=webp&wxfrom=5&wx_ lazy=1&wx_ co=1
Then back up the mnemonic words. You can copy the mnemonic words into the notebook, copy at least two copies and keep them in different places. After the mnemonic word backup is successful, the creation of coin security smart Chain Wallet is completed.
Support BNB and bep20 token storage and transfer
After creating the coin an intelligent energy chain wallet, you can use the wallet account to transfer and collect money.
640? wx_ fmt=jpeg&tp=webp&wxfrom=5&wx_ lazy=1&wx_ co=1
640? wx_ fmt=png&tp=webp&wxfrom=5&wx_ lazy=1&wx_ co=1
Support coin security smart chain defi
Through tokenpocket's coin an smart Chain Wallet, you can connect to coin an smart chain defi products.
At present, TP wallet has launched many coin security smart chain defi products, including swap, loan and machine gun pool defi. (click [find] to enter easily)
640? wx_ fmt=jpeg&tp=webp&wxfrom=5&wx_ lazy=1&wx_ co=1
In the new product area of tokenpocket, you can see some coin security smart chain defi products recently launched, such as bounce, BSC swap, anyswap, yfii valut and cream. Through TP's coin security smart Chain Wallet, you can connect these defis for experience.
640? wx_ fmt=jpeg&tp=webp&wxfrom=5&wx_ lazy=1&wx_ co=1
In addition to defi products, you can also connect BSC block browser and some lottery games through TP's coin security smart Chain Wallet.

Imtoken wallet supports directly going to Etherscan to query the current transaction status. Click the red box to directly go to Etherscan to query or copy the URL to the browser to open and view the transaction display status.

There are several transaction statuses:
Type 1: let's take the transfer of kybernetwork as an example, success.
Type 2: out of gas (miner's fee shortage) you can see my previous article about miner's fee. I won't explain the concept in detail here. If there is the following display on Etherscan, it means "miner's fee shortage".
Type 3: bad instruction is a common type of error. However, although such transactions fail, miners' fees will still be deducted. And the transaction amount will be returned and the transaction will be cancelled.
Type 4: a reversed error occurs, which is an error encountered during the execution of the contract. However, although such a transaction fails, the miner's fee will still be deducted, and the transaction amount will be returned and the transaction will be cancelled.
Bad instruction and reverted errors appear. It is recommended that users directly ask for token items in the relevant token item party community

1、 What are the wallets that support heco fire coin ecological chain?

At present, the wallets supporting heco fire coin ecological chain are as follows:
Tokenpocket (TP) Wallet
Note: please download the latest version of TP (Android 1.1.5, IOS 3.1.2, test flight download)
Download address: https://www.tokenpocket.pro/
You can choose to create a new one, or import a wallet and choose Huo coin ecological chain
Bitkeep Wallet
Note: please use the latest version of bitkeep app (Android 4.6.7)
Download address: https://bitkeep.org/
Huobi Wallet
Download address: https://www.huobiwallet.com/zh/
Hyperpay Wallet
Download address: https://www.hyperpay.tech/
2、 How to set up Ethereum wallet on PC side?
It is recommended to use metamask, which is similar to other Ethereum wallet viewer plug-ins
If you already have metamask, you can support the use of fire coin ecological chain (heco) after a simple step of setting
Metamask setup heco tutorial
Metamask little fox wallet download address https://metamask.io/
1. Click the Ethereum master network in the upper right corner
2. Click Customize RPC
3. Set custom network:
Network name (customizable and easy to identify): heco main network
Add RPC URL: https://http-mainnet.hecochain.com
Chainid: 128
Symbol: HT
Mask manager URL (the translation of metamask here is incorrect, which is actually a browser): https://scan.hecochain.com
Examples of settings are as follows:
Click Save to save

The concept of cold wallet sounds high and simple.

In vernacular, in order to clarify several concepts:

The private key is a string of characters, which is your money.

Bitcoin address is the entrance to save money.

The essence of bitcoin wallet is a private key generator, which only has the transfer function of bitcoin.

As long as you have the private key in your hand, it doesn't matter what wallet you use. Because the private key is money, the wallet is just a tool.

So the key is to generate your private key, not what wallet to use.

When you generate bitcoin wallets, most of them are online.

The network means insecurity, which means that your private key is exposed on the network. How is there the risk of theft.

Cold storage is a way to ensure the security of encrypted currency by generating addresses offline, which means that it is almost impossible for private key hackers to crack.

Therefore, when using wallet software to generate private keys, two things should be paid attention to:

Ensure that the private key is generated offline and will never be exposed to the network.

Ensure that the software used to generate the private key is reliable and free of vulnerabilities.

How to accept bitcoin when the cold wallet is not connected to the Internet?



Here's the point. Let's move on to the theme:

1. If you have never connected to the Internet, it is perfect to prepare a computer.

(of course, there is no way to install the operating system without networking)

If you have special property to protect and pursue extreme security, it is recommended to use raspberry PI, which is a very cheap way. (you can reformat and restore every time you use the network.

2. Prepare a USB flash disk.

3. Recommend a website: https://www.bitadress.org/ , this is an open source website that can be safely used.

4. Right click to store the website in USB flash disk.

5. Open this web site on a computer that is not connected. Manually mouse to generate bitcoin private key and address.

6. Copy the private key and address to the USB flash drive and print it on paper.

7. Store the USB flash disk and paper in the safe, and it is better to back up more.

8. This bitcoin address can be used to receive coins safely Deposit money.

Note: bitcoin wallet is a random number generator. Most bitcoin wallets are randomly generated through software programs, while https://www.bitaddress.com The generation method of Org / basically realizes real randomness, because when you move the mouse, you may not know what kind of pattern you will draw.

This random way basically realizes that the private key is not brutally cracked

In the process of investing in BTC, we should be familiar with at least one BTC wallet, which is the most basic requirement. For friends who have just entered this industry, they usually put BTC in the exchange. In fact, these BTCs are stored in the bitcoin wallet of the exchange. The private key of the wallet is in the hands of the exchange and does not belong to our management. In theory, the exchange can escape and take the assets in your wallet.

In fact, only when the private key is in our own hands can we fully control the assets, which is also a feature of blockchain digital assets. In the world of digital assets, the private key is everything. Mastering the private key means owning digital assets. If the private key is lost, it means that the assets controlled by the private key are lost. For example, if the private key of bitcoin wallet is lost, this part of BTC will be lost forever.

In BTC digital wallets, wallets can be divided into cold wallets and hot wallets according to whether they touch the Internet or not. Cold wallet, i.e. offline wallet, i.e. the device on which the wallet is installed is offline. Because there is no Internet, the private key cannot spread on the Internet, so the cold wallet is much safer. For example, we can use offline mobile phones to create cold wallets, or use computers without Internet to create cold wallets. Strictly speaking, copying the private key on paper is also called a cold wallet.

Accordingly, a hot wallet is an online wallet. Since the device is online and the private key has the risk of online transmission, in theory, hot wallet is not as safe as cold wallet. The mobile wallet we usually use is basically a hot wallet (after all, this mobile phone).

Therefore, for the sake of security, we'd better put the BTC that we don't intend to trade recently in the cold wallet, which can ensure the security of assets to a great extent. Of course, whether it is a hot wallet or a cold wallet, the private key must be kept. For example, copy three copies, one for yourself, one for your parents, and the other in the safe.

How to create BTC cold wallet?

1. Create bitcoin cold wallet.

Take the BTC wallet of tokenpocket as an example to illustrate how to build a bitcoin cold wallet.

1. Find a mobile phone that is often not used. First download tokenpocket online (HTTPS: / www.tokenpocket. Pro /), and then turn off the network. For example, cut off WiFi or adjust the mobile phone to flight mode. Install the tokenpocket wallet on the mobile phone when offline.

2. After installing tokenpocket, select import wallet and bitcoin in the wallet system.

3. Select "cold wallet" in the import method.

4. In the cold wallet interface, enter mnemonic words, and then set the wallet password. After entering, click Start import below.

5. After successful import, create a cold wallet, as shown in the figure below.

Hot and cold wallets communicate through QR code scanning, and the private key does not touch the Internet, which can effectively prevent hackers from stealing.

2. Create a hot wallet.

After the cold wallet is completed, now create a hot wallet. The cold wallet needs to cooperate with the hot wallet to complete the final transfer.

1. Open the cold wallet in turn: "my - > Manage wallet", and then select the corresponding BTC wallet.

2. Open "advanced mode" in wallet details, and then click "configure observation wallet". Click to pop up the QR code.

3. Use another online TP wallet to scan the QR code generated in the above steps and import it into the wallet. Now, the creation of the observation wallet has been completed. Observing the wallet allows you to observe the assets of the wallet, but you do not have operation permission.

3. Use the cold wallet (with the hot wallet) to complete the transfer.

Hot wallet can be created with cold wallet and hot wallet after authorization. The specific steps are as follows.

1. Enter the transfer address, amount and other information in the wallet, then generate the data to be signed and display it in the wallet in the form of QR code, as shown in the following figure.

Note: do not close this interface, the last step needs to be used.

2. Then scan the QR code with the corresponding cold wallet. After scanning the signature, the cold wallet will get the QR code.

Please note that you need to use the scan code signature (not the camera in the upper right corner) to scan and observe the QR code in your wallet. After scanning, you will pop up the signature information, click "confirm" and enter the password in the pop-up box. Then generate QR code.

The display uses the corresponding observation wallet to scan the code to complete the operation.

3. Finally, scan the QR code generated in the cold wallet with the observation wallet to complete the transfer operation.

When scanning with the observation wallet, scan the QR code in the cold wallet with the camera mark under the QR code in the observation wallet (step 1).

BTC transfers through cold wallet and hot wallet.

It can be seen that in the whole process, the cold wallet is authorized through the scanning code, and the cold wallet and the hot wallet communicate through the scanning code. During the whole transfer process, the private key does not contact the network.

The above is the whole process of making BTC cold wallet and transfer using tokenpocket. The process of creating a cold wallet for other BTC wallets is similar to the transfer process. I hope it will help you.

1、 Event summary.

Yesterday, with the exposure of microblog big v@ Xia Xueyi BTC, a new currency circle scam came into everyone's attention. For a time, everyone is in danger:

It may be: as long as you transfer usdt to the swindler through QR code, your account usdt will be transferred by the swindler. Why can a swindler control a user's wallet after a transfer?

The following is a brief analysis of criminal techniques.

2、 Process analysis.

Scan QR code:

Usdt fraud routine, tokenpocket wallet QR code theft, usdt security incident analysis.

Visit the following links:

After opening:

Usdt fraud routine, tokenpocket wallet QR code theft, usdt security incident analysis.

Scan the code with the tokenpocket wallet and try to transfer the money. Note that it must be the wave field chain. Note the upper left corner in the figure below:

Usdt fraud routine, tokenpocket wallet QR code theft, usdt security incident analysis.

During this process, you will find the following requests. Please note the method: approve!

Usdt fraud routine, tokenpocket wallet QR code theft, usdt security incident analysis.

Or use tronlonk to view:

Usdt fraud routine, tokenpocket wallet QR code theft, usdt security incident analysis.

The form of this contract is approve. The above figure refers to the request for approval of transfer of 90000 usdt!

The request signature here should be authorized, while tronscan recognizes the authorization as transfer.

Now you should understand that if you click to receive, approve authorizes you to authorize your usdt wallet to the attacker's address, and usdt within 90000 can be transferred by the attacker.

This method is also called approve fishing.

3、 Keep tracking.

The details of the signature request are as follows:

Usdt fraud routine, tokenpocket wallet QR code theft, usdt security incident analysis.

From the pop-up authorization, we can see the authorization of tvm7gsondpgup9sbtkwy2dhlvjhehgiy, and then check the transfer record of this address. We can see that all the transfer records of trc20 & trc721 show 90000:

Usdt fraud routine, tokenpocket wallet QR code theft, usdt security incident analysis.

These transfers are victims. This is actually a tronscan bug. 90000 is just authorization, not transfer.

For example, look at a transaction with a display amount of 90000:

to grant authorization:

Usdt fraud routine, tokenpocket wallet QR code theft, usdt security incident analysis.

It's just authorization. Xiaobai is prompted here. In fact, it's authorized to this address, which has nothing to do with the address displayed in the transfer interface.

Look at the victim's records:

Usdt fraud routine, tokenpocket wallet QR code theft, usdt security incident analysis.

Visible authorization 5 times, but not transferred out temporarily.

Several of them are like this and have not been transferred out. After unremitting search, we finally found a transfer out. It can be seen that the relatively large amount is 4276usdt:

Usdt fraud routine, tokenpocket wallet QR code theft, usdt security incident analysis.

It can also be seen from the above figure that tvm7gsondpgup9sbtkwy2dhlvhlvjhehgiy is the origination address, not the collection address, and the real collection address is taej7uzxallqjfx4bddnc1nishxrcfnqt.

Go to tronscan to check the income of this address, i.e. trc20 & trc721 transfer in record:

Usdt fraud routine, tokenpocket wallet QR code theft, usdt security incident analysis.

According to statistics, as of 12:50 pm on May 27, 2021, the first transaction occurred at 2021-05-2511:18:42 and the last transaction occurred at 2021-05-2709:52:45, with a cumulative amount of 120126.66usdt, about 780823.39 yuan.

In just two days, making money is faster than selling powder!

It can be seen that the attacker is a selective crime, and the amount of crime is generally more than 2000usdt. In other words, if you have too little usdt in your account, the attacker may despise it and get away with the transfer.

4、 Preventive measures.

When transferring money, be alert to approve fishing.

Or if it is impossible to prevent, try to transfer money through the address instead of scanning the QR code, because the QR code can carry too much information.

The tokenpocket wallet was stolen by the user. The above analysis missed the key step: how to sign and authorize the user. At present, the analysis only depends on starting the transfer, but how to sign? Is there a security error in the tokenpocket wallet itself?