You might find the token in your wallet cannot be sold. Actually you can’t do anything to it. What’s going on here? What happened to my token while it’s now sitting in my wallet? Is it a fake token? Or anything else? It’s been hacked? If so, how could I trace back my assets? How could I locate my asset if it is hacked?
What should I do when the assets in my wallet cannot be sold?
Identify the reason
First of all, what we need to do is to identify the reason why we can’t trade the asset.
Here it’s time to introduce our Token security detection, the killer feature empowered by GoPlus. The service is currently providing the most accurate results on a wide and comprehensive range of indicators, covering as many tokens in the market as possible and automatically keeping on adding newly issued tokens in the market. And now it has been integrated into many well-known blockchain products such as TokenPocket, AveDex, Mask, and Bitkeep.
Web3 is still in its infancy. Like any new emerging technology, the nascent crypto industry has often been compared to a digital “Wild West” — where the instant wealth not only attracts a large number of investment institutions and speculators, but also we see it makes hackers keep updating their scam techniques, creating new fraudulent tokens to lure victims into buying the tokens, and then ‘rug pulling’ all the money from the smart contracts. It seems that your assets cannot be traded, but if for a close speculation at a contract level, you would find there might be tricky code on the asset, which is the real reason why they can not be sold for a profit.
For most of the investors without coding background, it’s unrealistic to check on-chain contracts to see if there are any potential risks. Thanks to GoPlus Security, there is no need for every single user to be an on-chain sleuth. GoPlus is a crypto security infrastructure that enables you to analyze security risks around crypto assets and find related solutions. Besides the Malicious Address API, GoPlus offers you other security-related API services, including Token Security API, Approval Security, and NFT Security API. The token security detection would be conducted when assets can not be traded in today’s scenario. This is what we’re going to highlight later on.
Click the link and open the page of Token security detection at GoPlus. Fill in the token address, switch for the blockchain and check the result for the potential risks of security.
Click Check button and a complete security results would appear, including contract security, honeypot risk, holding distribution and percent of LP locked and more.
Most of the time the contract with malicious code is not open sourced and unverified so anyone couldn’t read them on-chain. In this case, DO NOT INVEST in any assets if the contract is closed. However, even if it is open sourced, the malicious code hidden in the contract could be used to build a scam to fool investors into buying them and then steal all the money. In most cases, the owner usually controls the most critical function related to money transfers of smart contracts, like preventing users from selling, increasing fee amount, etc.,which will lock user money into a contract and they will easily run away with users/investors’ funds.
On why a token be unable to be traded, there could be resulted by a few reasons as below:
- The code might put a limit on how many tokens you can sell, so you might need to lower the number of tokens you want to sell to resell it successfully.
- There is a sell tax deployed on the token, meaning you need to add extra tax to resell it successfully.
- There could be another possibility, in which, some of the tokens don’t allow the buyer to resell and only the owner may sell. This is achieved by deploying a malicious code on the contract. Finally, you go to place the sell order, but it doesn’t process; you can’t sell because the contract says that no one, except specific wallets ( the scammer ones), can sell. Your money is trapped forever, and there is nothing you can do about it.
A Real-World Case study on Token YES on BSC.
Contract Address:0xa0d6a99d3361f86e2565ae67d84c1dcbf8485156
After conducting a token detection for the given address, three security risks have been identified as below:
1. Tax can be modified
The contract owner may contain the authority to modify the transaction tax. If the transaction tax is increased to more than 49%, the tokens will not be able to be traded (honeypot risk).
Imagine you have a token worth $500, BUT to sell those tokens you need to pay an extra $500 as a sell tax. In most cases, the scammers usually lower the charge upon launching, then elevate it once users buy tokens to prevent token sales, and then dumps all the tokens for profit.
2. Blacklist function deployed by owners
Once the blacklist function is involved, it means some addresses may not be able to trade normally (honeypot risk). That’s why users find they can’t do anything about their assets. Most of the time, after the investors or users invest in tokens, scammers usually blacklist the token holders to prevent them from further trading tokens. After blacklisting users cannot perform any buying or selling for those tokens. In this way the scammers effectively steal funds from users.
3. Functions that can suspend trading
If a suspendable code is included, the token may neither be resold by the users (honeypot risk), but only the owner may sell them. the hacker would take advantage of this time to drain the pool and the token value then decreased to almost zero.
For any trouble with your NFT, GoPlus also offers NFT security detection service.
GoPlus NFT Security could detect a NFT from a contract level and tell if it is a fake one.In the context of more and more sneaky traps especially the innovative NFT honeypots and many more fake name NFT scams, GoPlus goes for NFT security detection on the over 20 security checkboxes in the contract level from whether it is open sourced, whether there is an agent, whether there is malicious behavior, whether there is a blacklist doubt, preventing users from getting scammed.
GoPlus NFT security API dominates the security market with full coverage of NFT projects(more than 160M) and the most verified NFTs ( more than 4M+ verified NFTs have been indexed so far).
Go check the link, enter the blockchain, the NFT address and check the result.
After clicking the detection button, a comprehensive security detection result will appear, including contract security, NFT credibility, transaction information, etc.
Investigate on chain activity to check where your assets have been
If none of the above solutions solve your problem and you are sure that your assets have been hacked, then the next step is to see where your assets have been transferred by checking on-chain activities.
Here are 3 tools you can use to check and investigate the on-chain activity.
1.MistTrack：
MistTrack is an anti-money laundering tracking system developed by the SlowMist AML. It could use on-chain analytics to assist in the tracing of illicit funds.
2.BlockSec Phalcon
BlockSec Phalcon is a transaction explorer where you can go check the balance changes for assets of all participating addresses
3.0xScope Watchers
0xScope Watchers enables us to find the address cluster related to the address you entered based on certainty level. This could be used to analyze all transactions belonging to an address based on the 0xScope address clustering and risk assessment algorithms.With this tool, an alert could be set to monitor the money flow, notify the real time market risk and track suspicious transactions.
Now we’ll demonstrate how to track assets using 0xScope Watchers
1. Here are three options we need to enter, the address, select the token types and the date range.
For the date range, it specifies to track the flow of the funds for a specific period of time, like the time window within 24 hours before an event happened. In order to make the track more accurate and clear, you should go check if there are other tokens the address has been traded during this period, and make the box checked if any. When all these are done, click search to generate the money flow involving the address.
2. Go check the button in the upper left corner of the address and choose how to expand
the money flow involving the address. You can check it by specific filters: Transfer Value,Transaction Count, and Transfer Token Amount, and you can choose how many addresses you like.
3. There would be different types of addresses popping up:
1: If it is a contract address, usually with a detailed tag of the contract project
2: If it is an EOA address, the address would be labeled with 0xscope styled tags ,like VC, Giant Whale, ENS, etc.
3: If it is a hot wallet address of an exchange would be displayed in the name of the exchange + wallet serial number
4: if it is a depositing address, usually displayed in a lowercase exchange name
Click on the line connecting any two addresses to look closely at all the transaction activities between the two addresses within a time window.
Now we’re done with all these transaction activities related to our funds and we can see how they’re being transferred and where they’re going for.
Try to recover it when funds go missing
After determining what our assets have gone through, you can trace back and get it back by trying some of the professional AML recovery tools.(disclaimer:We are just doing our best to recover assets but it cannot be guaranteed 100% success.)
1.mistTrack service
MistTrack Service aims to trace the on-chain transactions, monitor the associated addresses, analyse the profile for the hackers and assist law enforcement in contacting exchanges with evidence to freeze the deposit addresses of stolen funds. So far, the service has served over 60+ customers and helped recover assets of more than $960,000,000.
Click the link above and fill in the form.
2.Salus Security
Salus Security is a comprehensive blockchain security company that provides services such as smart contract auditing, automatic security detection, and customized services. And the recovery of stolen assets is one of the customized services that Salus is providing for the users.
Salus has been invested by Binance and also Salus has become an officially certified security service provider of Binance.
Click the link above and ask for an inquiry.