{
 "slug": "address-poisoning-4556-eth-jan-2026",
 "title": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
 "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026",
 "json": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026.json",
 "status": "closed",
 "severity": "critical",
 "threatStatus": "active",
 "verification": "verified",
 "chains": [
  "ethereum"
 ],
 "method": "address-poisoning",
 "product": "Ethereum whale wallet",
 "tags": [
  "ethereum",
  "address-poisoning",
  "eth",
  "dusting",
  "lookalike-address",
  "tornado-cash",
  "scam-sniffer",
  "whale"
 ],
 "amountUsd": 12250000,
 "victims": 1,
 "startedAt": "2026-01-30",
 "closedAt": "2026-01-31",
 "updatedAt": "2026-01-31T12:00:00Z",
 "summary": "On 30 January 2026 a victim sent 4,556 ETH, about $12.25M, to a lookalike of a regular counterparty's address. The attacker had seeded it into the victim's history with fake token transfers from February 2025 and ETH dust from October 2025; it matched the real address's first and last four characters. About 33 minutes later the ETH was swept to a new wallet, and the next day all of it went into Tornado Cash. Scam Sniffer flagged the loss.",
 "timeline": [
  {
   "date": "2025-02-25",
   "title": "The first forged token transfer tied to the lookalike address appeared, starting the poisoning of the victim's history.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum"
  },
  {
   "date": "2025-10-03",
   "title": "The first ETH dust from the lookalike address arrived; another dust ping followed on 29 January 2026.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum"
  },
  {
   "date": "2026-01-30",
   "title": "The victim sent 4,556 ETH to the lookalike 0x6d9052...2e48 instead of the intended 0x6D90CC...2E48; about 33 minutes later it was swept to a new wallet.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum"
  },
  {
   "date": "2026-01-31",
   "title": "All 4,556 ETH was deposited into Tornado Cash in 56 deposits.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum"
  },
  {
   "date": "2026-01-31",
   "title": "Scam Sniffer publicly reported the $12.25M address-poisoning loss.",
   "sourceUrl": "https://www.cryptopolitan.com/address-poison-attack-victim-loses-12-25m/"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "Address poisoning attack victim loses $12.25M",
   "url": "https://www.cryptopolitan.com/address-poison-attack-victim-loses-12-25m/",
   "publisher": "Cryptopolitan",
   "date": "2026-01-31"
  },
  {
   "kind": "onchain",
   "title": "Address poisoning on Ethereum: on-chain investigation",
   "url": "https://bitquery.io/investigations/address-poisoning-ethereum",
   "publisher": "Bitquery",
   "date": "2026-08-11"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": [
   "0x6d9052b2DF589De00324127fe2707eb34e592e48",
   "0x49a21fc945312c6fb4f8c6c4d224e74a5b96e9df"
  ]
 },
 "brief": "## Am I affected?\nIf you send large amounts to the same counterparties, look for incoming zero-value token transfers or tiny ETH amounts from addresses that start and end like theirs. This attacker prepared for almost a year before the theft.\n\n## What to do now\n- Stop copying addresses from history. Confirm the recipient through a separate channel (for example a message from the counterparty) before large transfers.\n- If funds were just sent, alert exchanges and security responders immediately; ETH cannot be frozen by an issuer.\n\n## How to avoid this\n- Use address-book entries, ENS names or a whitelist for repeat recipients.\n- Compare every character of the address on a hardware wallet screen before approving.\n- For large transfers, have a second person check the full address.",
 "notes": null,
 "agentBrief": "# Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier\n\n- Severity: Critical · Status: Still active (past)\n- Chains: Ethereum · Method: Address poisoning\n- Started: Jan 30, 2026 · Last update: Jan 31, 2026 · Reported stolen: $12M · Victims: 1\n- Who/what: Ethereum whale wallet\n\nOn 30 January 2026 a victim sent 4,556 ETH, about $12.25M, to a lookalike of a regular counterparty's address. The attacker had seeded it into the victim's history with fake token transfers from February 2025 and ETH dust from October 2025; it matched the real address's first and last four characters. About 33 minutes later the ETH was swept to a new wallet, and the next day all of it went into Tornado Cash. Scam Sniffer flagged the loss.\n\n## Am I affected?\nIf you send large amounts to the same counterparties, look for incoming zero-value token transfers or tiny ETH amounts from addresses that start and end like theirs. This attacker prepared for almost a year before the theft.\n\n## What to do now\n- Stop copying addresses from history. Confirm the recipient through a separate channel (for example a message from the counterparty) before large transfers.\n- If funds were just sent, alert exchanges and security responders immediately; ETH cannot be frozen by an issuer.\n\n## How to avoid this\n- Use address-book entries, ENS names or a whitelist for repeat recipients.\n- Compare every character of the address on a hardware wallet screen before approving.\n- For large transfers, have a second person check the full address.\n\n## Indicators (block these, never visit them)\n- Address: 0x6d9052b2DF589De00324127fe2707eb34e592e48\n- Address: 0x49a21fc945312c6fb4f8c6c4d224e74a5b96e9df\n\n## Sources\n- Address poisoning attack victim loses $12.25M (Cryptopolitan, 2026-01-31): https://www.cryptopolitan.com/address-poison-attack-victim-loses-12-25m/\n- Address poisoning on Ethereum: on-chain investigation (Bitquery, 2026-08-11): https://bitquery.io/investigations/address-poisoning-ethereum\n\nFull record: https://drains.watch/i/address-poisoning-4556-eth-jan-2026 · JSON: https://drains.watch/i/address-poisoning-4556-eth-jan-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}