Address poisoning
5 incidents, 2 live. 18 days since the last new one.
5 drains in the last 12 months
5 drains in the last 12 months
3 drains in 2026
2 drains in 2025
Live
-
High✕Still active
User loses about $305K in DAI after copying a poisoned lookalike address from history
On 4 October 2026 GoPlus Security flagged a loss of about $305,000 in DAI. The attacker made an address with the same first and last characters as the victim's usual recipient, sent dust transfers so it appeared in the victim's history, and the victim copied it for a large transfer. GoPlus warned these campaigns are now fully automated, from finding targets to laundering. Reports did not name the chain.
A DAI holder sending to a regular counterparty·Multiple EVM chains·$305K stolen·Since Oct 4, 2026·
-
Critical✕Still active
Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses
Bitquery data reported by CryptoSlate shows scammers sent tiny 'dust' transfers from lookalike addresses to 4,497,798 Solana wallets between Oct 30, 2025 and Oct 7, 2026, betting that victims would later copy the fake address from their history. In a studied subset of poisoned wallets, 1,104 wallets paid a combined $940,106 to lookalikes, a figure the researchers call a floor. Receiving dust cannot drain a wallet; the loss happens only when you send to the wrong address. Copy addresses from your exchange's deposit page or a saved contact, never from transaction history.
Solana wallet users sending to exchange deposit addresses·Solana·$940K stolen·Since Nov 17, 2025·
Past
January 2026 2
-
Critical✕Still active
Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier
On 30 January 2026 a victim sent 4,556 ETH, about $12.25M, to a lookalike of a regular counterparty's address. The attacker had seeded it into the victim's history with fake token transfers from February 2025 and ETH dust from October 2025; it matched the real address's first and last four characters. About 33 minutes later the ETH was swept to a new wallet, and the next day all of it went into Tornado Cash. Scam Sniffer flagged the loss.
Ethereum whale wallet·Ethereum·$12M stolen·Since Jan 30, 2026·
-
High✕Still active
Ethereum user loses $514K in USDT to address poisoning two minutes after a test transfer
On 16 January 2026 a victim sent a 5,000 USDT test transfer and, two minutes later, 509,000 USDT to a lookalike Ethereum address planted by an address-poisoning scammer, a total loss of about $514,000. The intended address ended in D3E6F; the fake ended in f3e6F and differed only in the middle characters wallets usually hide. Cyvers flagged the theft.
Ethereum USDT holder·Ethereum·$514K stolen·Since Jan 16, 2026·
December 2025 1
-
Critical✕Still active
Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history
On 20 December 2025 a trader sent a 50 USDT test to the correct address, then 26 minutes later sent 49,999,950 USDT on Ethereum to a lookalike address the attacker had planted in their transaction history. The fake matched the first five and last four characters of the real address. Within 30 minutes the funds were swapped to DAI, then to about 16,690 ETH, and almost all of it went into Tornado Cash. Always check the full address, not just the start and end.
Ethereum USDT holder (funds withdrawn from Binance)·Ethereum·$50M stolen·Since Dec 20, 2025·
No drains match these filters.