{
 "tag": "lookalike-address",
 "name": "Lookalike Address",
 "group": "Other",
 "incidents": [
  {
   "slug": "address-poisoning-305k-dai-oct-2026",
   "title": "User loses about $305K in DAI after copying a poisoned lookalike address from history",
   "url": "https://drains.watch/i/address-poisoning-305k-dai-oct-2026",
   "json": "https://drains.watch/i/address-poisoning-305k-dai-oct-2026.json",
   "status": "live",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "multi-evm"
   ],
   "method": "address-poisoning",
   "product": "A DAI holder sending to a regular counterparty",
   "tags": [
    "multi-evm",
    "address-poisoning",
    "dust-attack",
    "lookalike-address",
    "dai",
    "stablecoin",
    "goplus"
   ],
   "amountUsd": 305000,
   "victims": 1,
   "startedAt": "2026-10-04",
   "closedAt": null,
   "updatedAt": "2026-10-05T12:00:00Z",
   "summary": "On 4 October 2026 GoPlus Security flagged a loss of about $305,000 in DAI. The attacker made an address with the same first and last characters as the victim's usual recipient, sent dust transfers so it appeared in the victim's history, and the victim copied it for a large transfer. GoPlus warned these campaigns are now fully automated, from finding targets to laundering. Reports did not name the chain."
  },
  {
   "slug": "address-poisoning-4556-eth-jan-2026",
   "title": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026",
   "json": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "address-poisoning",
   "product": "Ethereum whale wallet",
   "tags": [
    "ethereum",
    "address-poisoning",
    "eth",
    "dusting",
    "lookalike-address",
    "tornado-cash",
    "scam-sniffer",
    "whale"
   ],
   "amountUsd": 12250000,
   "victims": 1,
   "startedAt": "2026-01-30",
   "closedAt": "2026-01-31",
   "updatedAt": "2026-01-31T12:00:00Z",
   "summary": "On 30 January 2026 a victim sent 4,556 ETH, about $12.25M, to a lookalike of a regular counterparty's address. The attacker had seeded it into the victim's history with fake token transfers from February 2025 and ETH dust from October 2025; it matched the real address's first and last four characters. About 33 minutes later the ETH was swept to a new wallet, and the next day all of it went into Tornado Cash. Scam Sniffer flagged the loss."
  },
  {
   "slug": "address-poisoning-514k-usdt-jan-2026",
   "title": "Ethereum user loses $514K in USDT to address poisoning two minutes after a test transfer",
   "url": "https://drains.watch/i/address-poisoning-514k-usdt-jan-2026",
   "json": "https://drains.watch/i/address-poisoning-514k-usdt-jan-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "address-poisoning",
   "product": "Ethereum USDT holder",
   "tags": [
    "ethereum",
    "address-poisoning",
    "usdt",
    "test-transaction",
    "lookalike-address",
    "cyvers"
   ],
   "amountUsd": 514000,
   "victims": 1,
   "startedAt": "2026-01-16",
   "closedAt": "2026-01-16",
   "updatedAt": "2026-01-16T12:00:00Z",
   "summary": "On 16 January 2026 a victim sent a 5,000 USDT test transfer and, two minutes later, 509,000 USDT to a lookalike Ethereum address planted by an address-poisoning scammer, a total loss of about $514,000. The intended address ended in D3E6F; the fake ended in f3e6F and differed only in the middle characters wallets usually hide. Cyvers flagged the theft."
  },
  {
   "slug": "address-poisoning-50m-usdt-dec-2025",
   "title": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history",
   "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025",
   "json": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "address-poisoning",
   "product": "Ethereum USDT holder (funds withdrawn from Binance)",
   "tags": [
    "ethereum",
    "address-poisoning",
    "usdt",
    "test-transaction",
    "lookalike-address",
    "tornado-cash",
    "binance-withdrawal"
   ],
   "amountUsd": 49999950,
   "victims": 1,
   "startedAt": "2025-12-20",
   "closedAt": "2025-12-20",
   "updatedAt": "2025-12-20T12:00:00Z",
   "summary": "On 20 December 2025 a trader sent a 50 USDT test to the correct address, then 26 minutes later sent 49,999,950 USDT on Ethereum to a lookalike address the attacker had planted in their transaction history. The fake matched the first five and last four characters of the real address. Within 30 minutes the funds were swapped to DAI, then to about 16,690 ETH, and almost all of it went into Tornado Cash. Always check the full address, not just the start and end."
  }
 ],
 "changes": [
  {
   "incident": "address-poisoning-305k-dai-oct-2026",
   "incidentTitle": "User loses about $305K in DAI after copying a poisoned lookalike address from history",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-05",
   "title": "Incrypted published the addresses involved: the poison address matched the intended recipient's first three and last six hex characters.",
   "sourceUrl": "https://incrypted.com/it/gli-utenti-crypto-hanno-perso-472-000-dollari-a-causa-di-indirizzi-falsi-e-firme-di-phishing/",
   "url": "https://drains.watch/i/address-poisoning-305k-dai-oct-2026"
  },
  {
   "incident": "address-poisoning-305k-dai-oct-2026",
   "incidentTitle": "User loses about $305K in DAI after copying a poisoned lookalike address from history",
   "severity": "high",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-04",
   "title": "GoPlus Security reported the roughly $305,000 DAI loss and warned that address-poisoning campaigns are now fully automated.",
   "sourceUrl": "https://phemex.com/news/article/user-loses-305000-in-dai-to-automated-address-poisoning-attack-98744",
   "url": "https://drains.watch/i/address-poisoning-305k-dai-oct-2026"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-31",
   "title": "All 4,556 ETH was deposited into Tornado Cash in 56 deposits.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-31",
   "title": "Scam Sniffer publicly reported the $12.25M address-poisoning loss.",
   "sourceUrl": "https://www.cryptopolitan.com/address-poison-attack-victim-loses-12-25m/",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-30",
   "title": "The victim sent 4,556 ETH to the lookalike 0x6d9052...2e48 instead of the intended 0x6D90CC...2E48; about 33 minutes later it was swept to a new wallet.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  },
  {
   "incident": "address-poisoning-514k-usdt-jan-2026",
   "incidentTitle": "Ethereum user loses $514K in USDT to address poisoning two minutes after a test transfer",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-16",
   "title": "Around 14:01 UTC the victim sent a 5,000 USDT test and then 509,000 USDT to a lookalike address.",
   "sourceUrl": "https://cryptonews.net/news/security/32290951/",
   "url": "https://drains.watch/i/address-poisoning-514k-usdt-jan-2026"
  },
  {
   "incident": "address-poisoning-514k-usdt-jan-2026",
   "incidentTitle": "Ethereum user loses $514K in USDT to address poisoning two minutes after a test transfer",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-16",
   "title": "Cyvers Alerts posted a warning about the theft at 14:34 UTC.",
   "sourceUrl": "https://cryptonews.net/news/security/32290951/",
   "url": "https://drains.watch/i/address-poisoning-514k-usdt-jan-2026"
  },
  {
   "incident": "address-poisoning-50m-usdt-dec-2025",
   "incidentTitle": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-20",
   "title": "At 03:06 UTC the victim sent a 50 USDT test to the intended address; a script then created a lookalike address and sent small transfers to poison the wallet's history.",
   "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return",
   "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025"
  },
  {
   "incident": "address-poisoning-50m-usdt-dec-2025",
   "incidentTitle": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-20",
   "title": "At 03:32 UTC the victim copied the lookalike address from history and sent 49,999,950 USDT to it.",
   "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return",
   "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025"
  },
  {
   "incident": "address-poisoning-50m-usdt-dec-2025",
   "incidentTitle": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-20",
   "title": "Within 30 minutes the USDT was swapped to DAI via MetaMask Swap, converted to about 16,690 ETH, and about 16,680 ETH was deposited into Tornado Cash.",
   "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return",
   "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025"
  },
  {
   "incident": "address-poisoning-50m-usdt-dec-2025",
   "incidentTitle": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-20",
   "title": "The victim posted an on-chain message offering a $1M bounty for return of 98% of the funds and said a criminal case had been filed.",
   "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return",
   "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-10-03",
   "title": "The first ETH dust from the lookalike address arrived; another dust ping followed on 29 January 2026.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  },
  {
   "incident": "address-poisoning-4556-eth-jan-2026",
   "incidentTitle": "Investor sends 4,556 ETH ($12.25M) to a poisoned lookalike address planted months earlier",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-02-25",
   "title": "The first forged token transfer tied to the lookalike address appeared, starting the poisoning of the victim's history.",
   "sourceUrl": "https://bitquery.io/investigations/address-poisoning-ethereum",
   "url": "https://drains.watch/i/address-poisoning-4556-eth-jan-2026"
  }
 ]
}