CREATE2 Drainer Attacks: How Scammers Bypass Wallet Warnings

CREATE2 Drainer Attacks: How Scammers Predeploy Malicious Contracts to Bypass Wallet Warnings

• On-chain security is a perpetual cat-and-mouse game. As decentralized applications evolve, digital wallets and their security extensions continuously improve their alert systems. By simulating transactions before a user clicks "confirm," these tools successfully curbed standard phishing attacks for a time by warning us when a contract was suspicious.

But cybercriminals quickly found a structural loophole embedded directly in the Ethereum Virtual Machine (EVM): the CREATE2 opcode.

• By exploiting this native deployment function, scammers bypass transaction simulators and blacklists. The catch? They get you to approve transfer permissions for a contract that does not yet exist on the blockchain.

• To understand this exploit, we must look at how the EVM deploys contracts. Traditionally, with the standard CREATE opcode, a contract's final address is calculated dynamically using the creator's address and their transaction history (nonce).

• The Constantinople upgrade introduced CREATE2. This function allows developers to pre-calculate the exact address where a contract will live before its code is actually written to the network.

• The calculation is performed deterministically using a fixed formula that combines a pre-established constant, the deploying contract's address, an arbitrary random value (called salt), and the initialization code of the contract itself.

This predictability is fantastic for legitimate DeFi tools (like creating Uniswap pools), but for scammers, it is the perfect disguise.

2. The Phishing Blueprint: Step-by-Step

The predeployment attack is designed to exploit the temporal gap between the user's signature and the actual deployment of the contract on the network.

• Step 1: The Invisible Setup. The attacker mathematically precomputes the address of their malicious contract but does not deploy it to the blockchain. In the ledger, that address remains an empty space with zero bytecode.

• Step 2: Fooling the Victim. The scammer creates a phishing website (a fake free airdrop, an NFT minting portal, or fake technical support). When connecting the wallet, the user is asked to sign a standard transaction (such as an ERC-20 approve() or an EIP-2612 permit signature) to grant spending allowances of their assets to this precomputed, non-existent address.

• Step 3: Evading Simulators. When analyzing the destination address, the wallet's security systems see that it is completely empty (no transaction history, not blacklisted, and no code). Since there is no bytecode to run simulations against, the transaction is shown as safe and approved without alerts.

• Step 4: The Final Blow. Once the user's signature is secured, the attacker executes an automated script that performs two actions in the exact same block: it deploys the malicious contract to the precomputed address and immediately triggers the signed permission to drain the tokens to their own account.

3. Comparison of Attacks

To clearly and directly illustrate how this evasion works compared to traditional attacks, we have summarized the system's behavior in the following table:

Method	Security Impact
CREATE2	Bypasses alerts by using temporary empty addresses.

4. The Real-World Impact

• The scale of this attack vector is alarming. Web3 security firm data reveals that drainers using this method have stolen tens of millions of dollars, affecting thousands of victims worldwide.

• Additionally, attackers combine CREATE2 with address poisoning techniques. They generate empty addresses on a massive scale until they find one that starts and ends with the same characters as a legitimate wallet the victim frequently interacts with. If the user accidentally copies this address from their transaction history, they send their funds directly into the trap.

5. Real-Time Telemetry and On-Chain Safety with DEXTools

• As smart contract exploits become increasingly automated, maintaining proactive security is essential. Relying blindly on wallet pop-ups is no longer enough; verifying the contracts we interact with is crucial.

• Before signing transactions on new platforms, claiming airdrops, or supplying liquidity to unfamiliar pools, verifying the underlying smart contracts is key. By pasting any contract address into the advanced DEXTools explorer, you can check pool liquidity, audit contract security, and track token distribution in real-time. This look-through telemetry helps you dodge the precomputed traps of modern drainers before committing your funds. 

Visit DEXTools and keep your operations safe!

The “No Clear Driver” Rule: When a Token Move Does Not Make Sense How to Check a Liquidity Pool Before Buying a Token 2026 Wallet Drainer Attacks Explained: How to Recognize and Avoid