{
 "tag": "cyvers",
 "name": "Cyvers",
 "group": "Other",
 "incidents": [
  {
   "slug": "address-poisoning-514k-usdt-jan-2026",
   "title": "Ethereum user loses $514K in USDT to address poisoning two minutes after a test transfer",
   "url": "https://drains.watch/i/address-poisoning-514k-usdt-jan-2026",
   "json": "https://drains.watch/i/address-poisoning-514k-usdt-jan-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "address-poisoning",
   "product": "Ethereum USDT holder",
   "tags": [
    "ethereum",
    "address-poisoning",
    "usdt",
    "test-transaction",
    "lookalike-address",
    "cyvers"
   ],
   "amountUsd": 514000,
   "victims": 1,
   "startedAt": "2026-01-16",
   "closedAt": "2026-01-16",
   "updatedAt": "2026-01-16T12:00:00Z",
   "summary": "On 16 January 2026 a victim sent a 5,000 USDT test transfer and, two minutes later, 509,000 USDT to a lookalike Ethereum address planted by an address-poisoning scammer, a total loss of about $514,000. The intended address ended in D3E6F; the fake ended in f3e6F and differed only in the middle characters wallets usually hide. Cyvers flagged the theft."
  }
 ],
 "changes": [
  {
   "incident": "address-poisoning-514k-usdt-jan-2026",
   "incidentTitle": "Ethereum user loses $514K in USDT to address poisoning two minutes after a test transfer",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-16",
   "title": "Around 14:01 UTC the victim sent a 5,000 USDT test and then 509,000 USDT to a lookalike address.",
   "sourceUrl": "https://cryptonews.net/news/security/32290951/",
   "url": "https://drains.watch/i/address-poisoning-514k-usdt-jan-2026"
  },
  {
   "incident": "address-poisoning-514k-usdt-jan-2026",
   "incidentTitle": "Ethereum user loses $514K in USDT to address poisoning two minutes after a test transfer",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-16",
   "title": "Cyvers Alerts posted a warning about the theft at 14:34 UTC.",
   "sourceUrl": "https://cryptonews.net/news/security/32290951/",
   "url": "https://drains.watch/i/address-poisoning-514k-usdt-jan-2026"
  }
 ]
}