Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history
Ethereum USDT holder (funds withdrawn from Binance)
On 20 December 2025 a trader sent a 50 USDT test to the correct address, then 26 minutes later sent 49,999,950 USDT on Ethereum to a lookalike address the attacker had planted in their transaction history. The fake matched the first five and last four characters of the real address. Within 30 minutes the funds were swapped to DAI, then to about 16,690 ETH, and almost all of it went into Tornado Cash. Always check the full address, not just the start and end.
Why this severity: $50M reported stolen, 1 victims, still active.
- Started
- Dec 20, 2025
- Closed
- Dec 20, 2025
- Chains
- Ethereum
- Method
- Address poisoning
- Reported stolen
- $50M
- Victims
- 1
At risk
- Ethereum USDT holder (funds withdrawn from Binance)
- Ethereum wallets
What to do now
- If you just sent funds to the wrong address, act within minutes: if the funds are still USDT or USDC, ask the issuer (Tether or Circle) to freeze them, and report to your exchange, the police and a security responder such as SEAL 911.
- Hide or ignore dust and zero-value transfers in your wallet.
Stay safe
Am I affected?
You are at risk if you copy recipient addresses from your wallet's recent activity or a block explorer. Tiny or zero-value transfers from addresses that look almost identical to ones you pay often are the poisoning step.
What to do now
- If you just sent funds to the wrong address, act within minutes: if the funds are still USDT or USDC, ask the issuer (Tether or Circle) to freeze them, and report to your exchange, the police and a security responder such as SEAL 911.
- Hide or ignore dust and zero-value transfers in your wallet.
How to avoid this
- Never copy a recipient from transaction history. Use a saved address-book entry or copy from the original source.
- Compare the whole address, character by character, or use ENS names and withdrawal whitelists.
- A test transaction only helps if the main transfer goes to the same, re-checked address.
- Keep your wallet's lookalike-address warnings switched on.
Timeline 4
The victim posted an on-chain message offering a $1M bounty for return of 98% of the funds and said a criminal case had been filed.
SourceWithin 30 minutes the USDT was swapped to DAI via MetaMask Swap, converted to about 16,690 ETH, and about 16,680 ETH was deposited into Tornado Cash.
SourceAt 03:32 UTC the victim copied the lookalike address from history and sent 49,999,950 USDT to it.
SourceAt 03:06 UTC the victim sent a 50 USDT test to the intended address; a script then created a lookalike address and sent small transfers to poison the wallet's history.
Source
News & write-ups ›1
How this method works
The attacker sends you a tiny or fake transfer from an address that looks like one you use, hoping you copy it from your history next time you send. Read about address poisoning →
Follow new drains and updates in your feed reader or Telegram RSS bot.