{
 "tag": "binance-withdrawal",
 "name": "Binance Withdrawal",
 "group": "Other",
 "incidents": [
  {
   "slug": "address-poisoning-50m-usdt-dec-2025",
   "title": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history",
   "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025",
   "json": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "address-poisoning",
   "product": "Ethereum USDT holder (funds withdrawn from Binance)",
   "tags": [
    "ethereum",
    "address-poisoning",
    "usdt",
    "test-transaction",
    "lookalike-address",
    "tornado-cash",
    "binance-withdrawal"
   ],
   "amountUsd": 49999950,
   "victims": 1,
   "startedAt": "2025-12-20",
   "closedAt": "2025-12-20",
   "updatedAt": "2025-12-20T12:00:00Z",
   "summary": "On 20 December 2025 a trader sent a 50 USDT test to the correct address, then 26 minutes later sent 49,999,950 USDT on Ethereum to a lookalike address the attacker had planted in their transaction history. The fake matched the first five and last four characters of the real address. Within 30 minutes the funds were swapped to DAI, then to about 16,690 ETH, and almost all of it went into Tornado Cash. Always check the full address, not just the start and end."
  }
 ],
 "changes": [
  {
   "incident": "address-poisoning-50m-usdt-dec-2025",
   "incidentTitle": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-20",
   "title": "At 03:06 UTC the victim sent a 50 USDT test to the intended address; a script then created a lookalike address and sent small transfers to poison the wallet's history.",
   "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return",
   "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025"
  },
  {
   "incident": "address-poisoning-50m-usdt-dec-2025",
   "incidentTitle": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-20",
   "title": "At 03:32 UTC the victim copied the lookalike address from history and sent 49,999,950 USDT to it.",
   "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return",
   "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025"
  },
  {
   "incident": "address-poisoning-50m-usdt-dec-2025",
   "incidentTitle": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-20",
   "title": "Within 30 minutes the USDT was swapped to DAI via MetaMask Swap, converted to about 16,690 ETH, and about 16,680 ETH was deposited into Tornado Cash.",
   "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return",
   "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025"
  },
  {
   "incident": "address-poisoning-50m-usdt-dec-2025",
   "incidentTitle": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-20",
   "title": "The victim posted an on-chain message offering a $1M bounty for return of 98% of the funds and said a criminal case had been filed.",
   "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return",
   "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025"
  }
 ]
}