{
 "slug": "address-poisoning-305k-dai-oct-2026",
 "title": "User loses about $305K in DAI after copying a poisoned lookalike address from history",
 "url": "https://drains.watch/i/address-poisoning-305k-dai-oct-2026",
 "json": "https://drains.watch/i/address-poisoning-305k-dai-oct-2026.json",
 "status": "live",
 "severity": "high",
 "threatStatus": "active",
 "verification": "verified",
 "chains": [
  "multi-evm"
 ],
 "method": "address-poisoning",
 "product": "A DAI holder sending to a regular counterparty",
 "tags": [
  "multi-evm",
  "address-poisoning",
  "dust-attack",
  "lookalike-address",
  "dai",
  "stablecoin",
  "goplus"
 ],
 "amountUsd": 305000,
 "victims": 1,
 "startedAt": "2026-10-04",
 "closedAt": null,
 "updatedAt": "2026-10-05T12:00:00Z",
 "summary": "On 4 October 2026 GoPlus Security flagged a loss of about $305,000 in DAI. The attacker made an address with the same first and last characters as the victim's usual recipient, sent dust transfers so it appeared in the victim's history, and the victim copied it for a large transfer. GoPlus warned these campaigns are now fully automated, from finding targets to laundering. Reports did not name the chain.",
 "timeline": [
  {
   "date": "2026-10-04",
   "title": "GoPlus Security reported the roughly $305,000 DAI loss and warned that address-poisoning campaigns are now fully automated.",
   "sourceUrl": "https://phemex.com/news/article/user-loses-305000-in-dai-to-automated-address-poisoning-attack-98744"
  },
  {
   "date": "2026-10-05",
   "title": "Incrypted published the addresses involved: the poison address matched the intended recipient's first three and last six hex characters.",
   "sourceUrl": "https://incrypted.com/it/gli-utenti-crypto-hanno-perso-472-000-dollari-a-causa-di-indirizzi-falsi-e-firme-di-phishing/"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "User loses $305,000 in DAI to automated address poisoning attack",
   "url": "https://phemex.com/news/article/user-loses-305000-in-dai-to-automated-address-poisoning-attack-98744",
   "publisher": "Phemex News (via PANews)",
   "date": "2026-10-04"
  },
  {
   "kind": "news",
   "title": "Gli utenti crypto hanno perso 472.000 dollari a causa di indirizzi falsi e firme di phishing",
   "url": "https://incrypted.com/it/gli-utenti-crypto-hanno-perso-472-000-dollari-a-causa-di-indirizzi-falsi-e-firme-di-phishing/",
   "publisher": "Incrypted",
   "date": "2026-10-05"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": [
   "0x085ccc21065c8c718fa0afcb4e842f247c18f1dd"
  ]
 },
 "brief": "## Am I affected?\nIf you often send to the same addresses and your history shows tiny or zero-value transfers from addresses that look like your contacts, you are being targeted. The danger is copying one of those addresses.\n\n## What to do now\n- Check the full recipient address of your recent large transfers against a saved, trusted copy.\n- A transfer to a poisoned address cannot be reversed. Report the address to the exchanges it touches and to police quickly, in case funds can be stopped downstream.\n\n## How to avoid this\n- Never copy an address from your transaction history or an explorer list. Use a saved address-book entry or get it fresh from the recipient.\n- Compare the whole address, not just the first and last few characters.\n- Send a small test amount and have the recipient confirm it before a large transfer.\n- Turn on your wallet's filter for zero-value and dust transfers if it has one.",
 "notes": null,
 "agentBrief": "# User loses about $305K in DAI after copying a poisoned lookalike address from history\n\n- Severity: High · Status: Still active (live)\n- Chains: Multiple EVM chains · Method: Address poisoning\n- Started: Oct 4, 2026 · Last update: Oct 5, 2026 · Reported stolen: $305K · Victims: 1\n- Who/what: A DAI holder sending to a regular counterparty\n\nOn 4 October 2026 GoPlus Security flagged a loss of about $305,000 in DAI. The attacker made an address with the same first and last characters as the victim's usual recipient, sent dust transfers so it appeared in the victim's history, and the victim copied it for a large transfer. GoPlus warned these campaigns are now fully automated, from finding targets to laundering. Reports did not name the chain.\n\n## Am I affected?\nIf you often send to the same addresses and your history shows tiny or zero-value transfers from addresses that look like your contacts, you are being targeted. The danger is copying one of those addresses.\n\n## What to do now\n- Check the full recipient address of your recent large transfers against a saved, trusted copy.\n- A transfer to a poisoned address cannot be reversed. Report the address to the exchanges it touches and to police quickly, in case funds can be stopped downstream.\n\n## How to avoid this\n- Never copy an address from your transaction history or an explorer list. Use a saved address-book entry or get it fresh from the recipient.\n- Compare the whole address, not just the first and last few characters.\n- Send a small test amount and have the recipient confirm it before a large transfer.\n- Turn on your wallet's filter for zero-value and dust transfers if it has one.\n\n## Indicators (block these, never visit them)\n- Address: 0x085ccc21065c8c718fa0afcb4e842f247c18f1dd\n\n## Sources\n- User loses $305,000 in DAI to automated address poisoning attack (Phemex News (via PANews), 2026-10-04): https://phemex.com/news/article/user-loses-305000-in-dai-to-automated-address-poisoning-attack-98744\n- Gli utenti crypto hanno perso 472.000 dollari a causa di indirizzi falsi e firme di phishing (Incrypted, 2026-10-05): https://incrypted.com/it/gli-utenti-crypto-hanno-perso-472-000-dollari-a-causa-di-indirizzi-falsi-e-firme-di-phishing/\n\nFull record: https://drains.watch/i/address-poisoning-305k-dai-oct-2026 · JSON: https://drains.watch/i/address-poisoning-305k-dai-oct-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}