# Ethereum user loses $514K in USDT to address poisoning two minutes after a test transfer

- Severity: High · Status: Still active (past)
- Chains: Ethereum · Method: Address poisoning
- Started: Jan 16, 2026 · Last update: Jan 16, 2026 · Reported stolen: $514K · Victims: 1
- Who/what: Ethereum USDT holder

On 16 January 2026 a victim sent a 5,000 USDT test transfer and, two minutes later, 509,000 USDT to a lookalike Ethereum address planted by an address-poisoning scammer, a total loss of about $514,000. The intended address ended in D3E6F; the fake ended in f3e6F and differed only in the middle characters wallets usually hide. Cyvers flagged the theft.

## Am I affected?
Check your history for zero-value or tiny transfers from addresses that share the first and last characters with addresses you use. If you see them, your wallet has been targeted.

## What to do now
- Don't copy any address from your transaction history; delete or hide the dust entries if your wallet allows it.
- If you already sent funds, report the transaction to Tether (for USDT), your exchange and the police right away.

## How to avoid this
- Save trusted recipients in your wallet's address book and send only from there.
- Check the full address, including the middle characters, before both the test and the main transfer.

## Sources
- Victim loses over $500,000 in USDT to address poisoning (Cryptopolitan, via Crypto News) (Cryptopolitan, 2026-01-16): https://cryptonews.net/news/security/32290951/

Full record: https://drains.watch/i/address-poisoning-514k-usdt-jan-2026 · JSON: https://drains.watch/i/address-poisoning-514k-usdt-jan-2026.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.