Ethereum user loses $514K in USDT to address poisoning two minutes after a test transfer
Ethereum USDT holder
On 16 January 2026 a victim sent a 5,000 USDT test transfer and, two minutes later, 509,000 USDT to a lookalike Ethereum address planted by an address-poisoning scammer, a total loss of about $514,000. The intended address ended in D3E6F; the fake ended in f3e6F and differed only in the middle characters wallets usually hide. Cyvers flagged the theft.
Why this severity: $514K reported stolen, 1 victims, still active.
- Started
- Jan 16, 2026
- Closed
- Jan 16, 2026
- Chains
- Ethereum
- Method
- Address poisoning
- Reported stolen
- $514K
- Victims
- 1
At risk
- Ethereum USDT holder
- Ethereum wallets
What to do now
- Don't copy any address from your transaction history; delete or hide the dust entries if your wallet allows it.
- If you already sent funds, report the transaction to Tether (for USDT), your exchange and the police right away.
Stay safe
Am I affected?
Check your history for zero-value or tiny transfers from addresses that share the first and last characters with addresses you use. If you see them, your wallet has been targeted.
What to do now
- Don't copy any address from your transaction history; delete or hide the dust entries if your wallet allows it.
- If you already sent funds, report the transaction to Tether (for USDT), your exchange and the police right away.
How to avoid this
- Save trusted recipients in your wallet's address book and send only from there.
- Check the full address, including the middle characters, before both the test and the main transfer.
Timeline 2
News & write-ups ›1
How this method works
The attacker sends you a tiny or fake transfer from an address that looks like one you use, hoping you copy it from your history next time you send. Read about address poisoning →
Follow new drains and updates in your feed reader or Telegram RSS bot.