{
 "slug": "address-poisoning-514k-usdt-jan-2026",
 "title": "Ethereum user loses $514K in USDT to address poisoning two minutes after a test transfer",
 "url": "https://drains.watch/i/address-poisoning-514k-usdt-jan-2026",
 "json": "https://drains.watch/i/address-poisoning-514k-usdt-jan-2026.json",
 "status": "closed",
 "severity": "high",
 "threatStatus": "active",
 "verification": "verified",
 "chains": [
  "ethereum"
 ],
 "method": "address-poisoning",
 "product": "Ethereum USDT holder",
 "tags": [
  "ethereum",
  "address-poisoning",
  "usdt",
  "test-transaction",
  "lookalike-address",
  "cyvers"
 ],
 "amountUsd": 514000,
 "victims": 1,
 "startedAt": "2026-01-16",
 "closedAt": "2026-01-16",
 "updatedAt": "2026-01-16T12:00:00Z",
 "summary": "On 16 January 2026 a victim sent a 5,000 USDT test transfer and, two minutes later, 509,000 USDT to a lookalike Ethereum address planted by an address-poisoning scammer, a total loss of about $514,000. The intended address ended in D3E6F; the fake ended in f3e6F and differed only in the middle characters wallets usually hide. Cyvers flagged the theft.",
 "timeline": [
  {
   "date": "2026-01-16",
   "title": "Around 14:01 UTC the victim sent a 5,000 USDT test and then 509,000 USDT to a lookalike address.",
   "sourceUrl": "https://cryptonews.net/news/security/32290951/"
  },
  {
   "date": "2026-01-16",
   "title": "Cyvers Alerts posted a warning about the theft at 14:34 UTC.",
   "sourceUrl": "https://cryptonews.net/news/security/32290951/"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "Victim loses over $500,000 in USDT to address poisoning (Cryptopolitan, via Crypto News)",
   "url": "https://cryptonews.net/news/security/32290951/",
   "publisher": "Cryptopolitan",
   "date": "2026-01-16"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nCheck your history for zero-value or tiny transfers from addresses that share the first and last characters with addresses you use. If you see them, your wallet has been targeted.\n\n## What to do now\n- Don't copy any address from your transaction history; delete or hide the dust entries if your wallet allows it.\n- If you already sent funds, report the transaction to Tether (for USDT), your exchange and the police right away.\n\n## How to avoid this\n- Save trusted recipients in your wallet's address book and send only from there.\n- Check the full address, including the middle characters, before both the test and the main transfer.",
 "notes": null,
 "agentBrief": "# Ethereum user loses $514K in USDT to address poisoning two minutes after a test transfer\n\n- Severity: High · Status: Still active (past)\n- Chains: Ethereum · Method: Address poisoning\n- Started: Jan 16, 2026 · Last update: Jan 16, 2026 · Reported stolen: $514K · Victims: 1\n- Who/what: Ethereum USDT holder\n\nOn 16 January 2026 a victim sent a 5,000 USDT test transfer and, two minutes later, 509,000 USDT to a lookalike Ethereum address planted by an address-poisoning scammer, a total loss of about $514,000. The intended address ended in D3E6F; the fake ended in f3e6F and differed only in the middle characters wallets usually hide. Cyvers flagged the theft.\n\n## Am I affected?\nCheck your history for zero-value or tiny transfers from addresses that share the first and last characters with addresses you use. If you see them, your wallet has been targeted.\n\n## What to do now\n- Don't copy any address from your transaction history; delete or hide the dust entries if your wallet allows it.\n- If you already sent funds, report the transaction to Tether (for USDT), your exchange and the police right away.\n\n## How to avoid this\n- Save trusted recipients in your wallet's address book and send only from there.\n- Check the full address, including the middle characters, before both the test and the main transfer.\n\n## Sources\n- Victim loses over $500,000 in USDT to address poisoning (Cryptopolitan, via Crypto News) (Cryptopolitan, 2026-01-16): https://cryptonews.net/news/security/32290951/\n\nFull record: https://drains.watch/i/address-poisoning-514k-usdt-jan-2026 · JSON: https://drains.watch/i/address-poisoning-514k-usdt-jan-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}