{
 "tag": "dust-attack",
 "name": "Dust Attack",
 "group": "Other",
 "incidents": [
  {
   "slug": "address-poisoning-305k-dai-oct-2026",
   "title": "User loses about $305K in DAI after copying a poisoned lookalike address from history",
   "url": "https://drains.watch/i/address-poisoning-305k-dai-oct-2026",
   "json": "https://drains.watch/i/address-poisoning-305k-dai-oct-2026.json",
   "status": "live",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "multi-evm"
   ],
   "method": "address-poisoning",
   "product": "A DAI holder sending to a regular counterparty",
   "tags": [
    "multi-evm",
    "address-poisoning",
    "dust-attack",
    "lookalike-address",
    "dai",
    "stablecoin",
    "goplus"
   ],
   "amountUsd": 305000,
   "victims": 1,
   "startedAt": "2026-10-04",
   "closedAt": null,
   "updatedAt": "2026-10-05T12:00:00Z",
   "summary": "On 4 October 2026 GoPlus Security flagged a loss of about $305,000 in DAI. The attacker made an address with the same first and last characters as the victim's usual recipient, sent dust transfers so it appeared in the victim's history, and the victim copied it for a large transfer. GoPlus warned these campaigns are now fully automated, from finding targets to laundering. Reports did not name the chain."
  }
 ],
 "changes": [
  {
   "incident": "address-poisoning-305k-dai-oct-2026",
   "incidentTitle": "User loses about $305K in DAI after copying a poisoned lookalike address from history",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-05",
   "title": "Incrypted published the addresses involved: the poison address matched the intended recipient's first three and last six hex characters.",
   "sourceUrl": "https://incrypted.com/it/gli-utenti-crypto-hanno-perso-472-000-dollari-a-causa-di-indirizzi-falsi-e-firme-di-phishing/",
   "url": "https://drains.watch/i/address-poisoning-305k-dai-oct-2026"
  },
  {
   "incident": "address-poisoning-305k-dai-oct-2026",
   "incidentTitle": "User loses about $305K in DAI after copying a poisoned lookalike address from history",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-04",
   "title": "GoPlus Security reported the roughly $305,000 DAI loss and warned that address-poisoning campaigns are now fully automated.",
   "sourceUrl": "https://phemex.com/news/article/user-loses-305000-in-dai-to-automated-address-poisoning-attack-98744",
   "url": "https://drains.watch/i/address-poisoning-305k-dai-oct-2026"
  }
 ]
}