New Web3 attack exploits transaction simulations to steal crypto