{
 "tag": "eth",
 "name": "ETH",
 "group": "Other",
 "incidents": [
  {
   "slug": "address-poisoning-4556-eth-jan-2026",
   "title": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026",
   "json": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "address-poisoning",
   "product": "Ethereum whale wallet",
   "tags": [
    "ethereum",
    "address-poisoning",
    "eth",
    "dusting",
    "lookalike-address",
    "tornado-cash",
    "scam-sniffer",
    "whale"
   ],
   "amountUsd": 12250000,
   "victims": 1,
   "startedAt": "2026-01-30",
   "closedAt": "2026-01-31",
   "updatedAt": "2026-01-31T12:00:00Z",
   "summary": "On 30 January 2026 a victim sent 4,556 ETH, about $12.25M, to a lookalike of a regular counterparty's address. The attacker had seeded it into the victim's history with fake token transfers from February 2025 and ETH dust from October 2025; it matched the real address's first and last four characters. About 33 minutes later the ETH was swept to a new wallet, and the next day all of it went into Tornado Cash. Scam Sniffer flagged the loss."
  },
  {
   "slug": "aixbt-ai-agent-dashboard-breach-55-eth-mar-2025",
   "title": "Attacker breaches AIXBT AI agent's dashboard and queues prompts that send 55.5 ETH from its wallet",
   "url": "https://drains.watch/i/aixbt-ai-agent-dashboard-breach-55-eth-mar-2025",
   "json": "https://drains.watch/i/aixbt-ai-agent-dashboard-breach-55-eth-mar-2025.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "contained",
   "verification": "verified",
   "ai": {
    "role": "agent-target",
    "note": "An attacker with access to the AIXBT agent's dashboard queued two prompts that instructed the AI agent to send 55.5 ETH from its wallet; the maintainer said the AI model itself was not manipulated."
   },
   "chains": [
    "base"
   ],
   "method": "agent-hijack",
   "product": "AIXBT AI agent wallet",
   "tags": [
    "base",
    "agent-hijack",
    "aixbt",
    "ai-agent",
    "agent-dashboard",
    "dashboard-compromise",
    "simulacrum",
    "eth",
    "ai"
   ],
   "amountUsd": 106200,
   "victims": 1,
   "startedAt": "2025-03-18",
   "closedAt": "2025-03-19",
   "updatedAt": "2025-03-19T12:00:00Z",
   "summary": "On 18 March 2025 an attacker got into the dashboard of AIXBT, an autonomous AI crypto agent, and queued two prompts that made it transfer about 55.5 ETH (about $106,200) out of its wallet on Base. The maintainer said core systems were not affected and the AI itself was not manipulated; the weak point was access to the agent's control dashboard. Keys were swapped, dashboard access was paused and the attacker's addresses were reported to exchanges. Anyone running an AI agent with a wallet should lock down its control panel and cap what it can send."
  }
 ],
 "changes": [
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-31",
   "title": "All 4,556 ETH was deposited into Tornado Cash in 56 deposits.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-31",
   "title": "Scam Sniffer publicly reported the $12.25M address-poisoning loss.",
   "sourceUrl": "https://www.cryptopolitan.com/address-poison-attack-victim-loses-12-25m/",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-30",
   "title": "The victim sent 4,556 ETH to the lookalike 0x6d9052...2e48 instead of the intended 0x6D90CC...2E48; about 33 minutes later it was swept to a new wallet.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-10-03",
   "title": "The first ETH dust from the lookalike address arrived; another dust ping followed on 29 January 2026.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  },
  {
   "incident": "aixbt-ai-agent-dashboard-breach-55-eth-mar-2025",
   "incidentTitle": "Attacker breaches AIXBT AI agent's dashboard and queues prompts that send 55.5 ETH from its wallet",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-03-19",
   "title": "Cointelegraph reported the maintainer's statement that servers were migrated, keys swapped and dashboard access paused, and that the AIXBT token fell about 15.5%.",
   "sourceUrl": "https://cointelegraph.com/news/hacker-breaches-ai-crypto-bot-aixbt-steals-55-eth",
   "url": "https://drains.watch/i/aixbt-ai-agent-dashboard-breach-55-eth-mar-2025"
  },
  {
   "incident": "aixbt-ai-agent-dashboard-breach-55-eth-mar-2025",
   "incidentTitle": "Attacker breaches AIXBT AI agent's dashboard and queues prompts that send 55.5 ETH from its wallet",
   "severity": "high",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-03-18",
   "title": "An attacker breached the AIXBT agent's dashboard and issued two prompts that moved about 55.5 ETH out of its wallet.",
   "sourceUrl": "https://cointelegraph.com/news/hacker-breaches-ai-crypto-bot-aixbt-steals-55-eth",
   "url": "https://drains.watch/i/aixbt-ai-agent-dashboard-breach-55-eth-mar-2025"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-02-25",
   "title": "The first forged token transfer tied to the lookalike address appeared, starting the poisoning of the victim's history.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  }
 ]
}