Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier
Ethereum whale wallet
On 30 January 2026 a victim sent 4,556 ETH, about $12.25M, to a lookalike of a regular counterparty's address. The attacker had seeded it into the victim's history with fake token transfers from February 2025 and ETH dust from October 2025; it matched the real address's first and last four characters. About 33 minutes later the ETH was swept to a new wallet, and the next day all of it went into Tornado Cash. Scam Sniffer flagged the loss.
Why this severity: $12M reported stolen, 1 victims, still active.
- Started
- Jan 30, 2026
- Closed
- Jan 31, 2026
- Chains
- Ethereum
- Method
- Address poisoning
- Reported stolen
- $12M
- Victims
- 1
Indicators · never visit or send to these
- 0x6d9052b2DF589De00324127fe2707eb34e592e48
- 0x49a21fc945312c6fb4f8c6c4d224e74a5b96e9df
What to do now
- Stop copying addresses from history. Confirm the recipient through a separate channel (for example a message from the counterparty) before large transfers.
- If funds were just sent, alert exchanges and security responders immediately; ETH cannot be frozen by an issuer.
Stay safe
Am I affected?
If you send large amounts to the same counterparties, look for incoming zero-value token transfers or tiny ETH amounts from addresses that start and end like theirs. This attacker prepared for almost a year before the theft.
What to do now
- Stop copying addresses from history. Confirm the recipient through a separate channel (for example a message from the counterparty) before large transfers.
- If funds were just sent, alert exchanges and security responders immediately; ETH cannot be frozen by an issuer.
How to avoid this
- Use address-book entries, ENS names or a whitelist for repeat recipients.
- Compare every character of the address on a hardware wallet screen before approving.
- For large transfers, have a second person check the full address.
Timeline 5
Scam Sniffer publicly reported the $12.25M address-poisoning loss.
SourceAll 4,556 ETH was deposited into Tornado Cash in 56 deposits.
SourceThe victim sent 4,556 ETH to the lookalike 0x6d9052...2e48 instead of the intended 0x6D90CC...2E48; about 33 minutes later it was swept to a new wallet.
SourceThe first ETH dust from the lookalike address arrived; another dust ping followed on 29 January 2026.
SourceThe first forged token transfer tied to the lookalike address appeared, starting the poisoning of the victim's history.
Source
Alerts & on-chain evidence 1
News & write-ups ›1
How this method works
The attacker sends you a tiny or fake transfer from an address that looks like one you use, hoping you copy it from your history next time you send. Read about address poisoning →
Follow new drains and updates in your feed reader or Telegram RSS bot.