# Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier

- Severity: Critical · Status: Still active (past)
- Chains: Ethereum · Method: Address poisoning
- Started: Jan 30, 2026 · Last update: Jan 31, 2026 · Reported stolen: $12M · Victims: 1
- Who/what: Ethereum whale wallet

On 30 January 2026 a victim sent 4,556 ETH, about $12.25M, to a lookalike of a regular counterparty's address. The attacker had seeded it into the victim's history with fake token transfers from February 2025 and ETH dust from October 2025; it matched the real address's first and last four characters. About 33 minutes later the ETH was swept to a new wallet, and the next day all of it went into Tornado Cash. Scam Sniffer flagged the loss.

## Am I affected?
If you send large amounts to the same counterparties, look for incoming zero-value token transfers or tiny ETH amounts from addresses that start and end like theirs. This attacker prepared for almost a year before the theft.

## What to do now
- Stop copying addresses from history. Confirm the recipient through a separate channel (for example a message from the counterparty) before large transfers.
- If funds were just sent, alert exchanges and security responders immediately; ETH cannot be frozen by an issuer.

## How to avoid this
- Use address-book entries, ENS names or a whitelist for repeat recipients.
- Compare every character of the address on a hardware wallet screen before approving.
- For large transfers, have a second person check the full address.

## Indicators (block these, never visit them)
- Address: 0x6d9052b2DF589De00324127fe2707eb34e592e48
- Address: 0x49a21fc945312c6fb4f8c6c4d224e74a5b96e9df

## Sources
- Address poisoning attack victim loses $12.25M (Cryptopolitan, 2026-01-31): https://www.cryptopolitan.com/address-poison-attack-victim-loses-12-25m/
- Address poisoning on Ethereum: on-chain investigation (Bitquery, 2026-08-11): https://bitquery.io/investigations/address-poisoning-ethereum

Full record: https://drains.watch/i/address-poisoning-4556-eth-jan-2026 · JSON: https://drains.watch/i/address-poisoning-4556-eth-jan-2026.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.