{
 "tag": "usdt",
 "name": "USDT",
 "group": "Other",
 "incidents": [
  {
   "slug": "usdt-approval-phishing-999999-jul-2026",
   "title": "Ethereum user loses 999,999 USDT after signing a phishing token approval",
   "url": "https://drains.watch/i/usdt-approval-phishing-999999-jul-2026",
   "json": "https://drains.watch/i/usdt-approval-phishing-999999-jul-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "approval-phishing",
   "product": "Ethereum USDT holder",
   "tags": [
    "ethereum",
    "approval-phishing",
    "usdt",
    "scam-sniffer",
    "multicall",
    "drainer"
   ],
   "amountUsd": 999999,
   "victims": 1,
   "startedAt": "2026-07-08",
   "closedAt": "2026-07-09",
   "updatedAt": "2026-07-09T12:00:00Z",
   "summary": "On 8 July 2026 an Ethereum user signed a phishing token approval and lost 999,999 USDT, nearly $1M, according to Scam Sniffer. The attacker used multicalls and pulled the funds out in three transactions. One signature on a fake site was enough to empty the stablecoin balance."
  },
  {
   "slug": "address-poisoning-514k-usdt-jan-2026",
   "title": "Ethereum user loses $514K in USDT to address poisoning two minutes after a test transfer",
   "url": "https://drains.watch/i/address-poisoning-514k-usdt-jan-2026",
   "json": "https://drains.watch/i/address-poisoning-514k-usdt-jan-2026.json",
   "status": "closed",
   "severity": "high",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "address-poisoning",
   "product": "Ethereum USDT holder",
   "tags": [
    "ethereum",
    "address-poisoning",
    "usdt",
    "test-transaction",
    "lookalike-address",
    "cyvers"
   ],
   "amountUsd": 514000,
   "victims": 1,
   "startedAt": "2026-01-16",
   "closedAt": "2026-01-16",
   "updatedAt": "2026-01-16T12:00:00Z",
   "summary": "On 16 January 2026 a victim sent a 5,000 USDT test transfer and, two minutes later, 509,000 USDT to a lookalike Ethereum address planted by an address-poisoning scammer, a total loss of about $514,000. The intended address ended in D3E6F; the fake ended in f3e6F and differed only in the middle characters wallets usually hide. Cyvers flagged the theft."
  },
  {
   "slug": "address-poisoning-50m-usdt-dec-2025",
   "title": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history",
   "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025",
   "json": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "ethereum"
   ],
   "method": "address-poisoning",
   "product": "Ethereum USDT holder (funds withdrawn from Binance)",
   "tags": [
    "ethereum",
    "address-poisoning",
    "usdt",
    "test-transaction",
    "lookalike-address",
    "tornado-cash",
    "binance-withdrawal"
   ],
   "amountUsd": 49999950,
   "victims": 1,
   "startedAt": "2025-12-20",
   "closedAt": "2025-12-20",
   "updatedAt": "2025-12-20T12:00:00Z",
   "summary": "On 20 December 2025 a trader sent a 50 USDT test to the correct address, then 26 minutes later sent 49,999,950 USDT on Ethereum to a lookalike address the attacker had planted in their transaction history. The fake matched the first five and last four characters of the real address. Within 30 minutes the funds were swapped to DAI, then to about 16,690 ETH, and almost all of it went into Tornado Cash. Always check the full address, not just the start and end."
  },
  {
   "slug": "solana-address-poisoning-wave-2025-2026",
   "title": "Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses",
   "url": "https://drains.watch/i/solana-address-poisoning-wave-2025-2026",
   "json": "https://drains.watch/i/solana-address-poisoning-wave-2025-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "active",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": "address-poisoning",
   "product": "Solana wallet users sending to exchange deposit addresses",
   "tags": [
    "solana",
    "address-poisoning",
    "dusting",
    "usdt",
    "usdc",
    "phantom",
    "exchange-deposit",
    "bitquery"
   ],
   "amountUsd": 940106,
   "victims": 1104,
   "startedAt": "2025-11-17",
   "closedAt": null,
   "updatedAt": "2026-10-12T12:00:00Z",
   "summary": "Bitquery data reported by CryptoSlate shows scammers sent tiny 'dust' transfers from lookalike addresses to 4,497,798 Solana wallets between Oct 30, 2025 and Oct 7, 2026, betting that victims would later copy the fake address from their history. In a studied subset of poisoned wallets, 1,104 wallets paid a combined $940,106 to lookalikes, a figure the researchers call a floor. Receiving dust cannot drain a wallet; the loss happens only when you send to the wrong address. Copy addresses from your exchange's deposit page or a saved contact, never from transaction history."
  }
 ],
 "changes": [
  {
   "incident": "solana-address-poisoning-wave-2025-2026",
   "incidentTitle": "Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-12",
   "title": "CryptoSlate reported that 1,104 wallets in a studied subset paid $940,106 to poisoned addresses, described as a minimum.",
   "sourceUrl": "https://cryptoslate.com/?p=571247",
   "url": "https://drains.watch/i/solana-address-poisoning-wave-2025-2026"
  },
  {
   "incident": "solana-address-poisoning-wave-2025-2026",
   "incidentTitle": "Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2026-10-09",
   "title": "Bitquery published findings that 4,497,798 Solana wallets were targeted with lookalike addresses over about 11 months.",
   "sourceUrl": "https://cryptoslate.com/?p=571247",
   "url": "https://drains.watch/i/solana-address-poisoning-wave-2025-2026"
  },
  {
   "incident": "usdt-approval-phishing-999999-jul-2026",
   "incidentTitle": "Ethereum user loses 999,999 USDT after signing a phishing token approval",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-09",
   "title": "Scam Sniffer posted an alert about the loss.",
   "sourceUrl": "https://cointelegraph.com/news/trader-loses-1m-after-signing-phishing-token-approval",
   "url": "https://drains.watch/i/usdt-approval-phishing-999999-jul-2026"
  },
  {
   "incident": "usdt-approval-phishing-999999-jul-2026",
   "incidentTitle": "Ethereum user loses 999,999 USDT after signing a phishing token approval",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-07-08",
   "title": "The victim signed a phishing token approval and the attacker pulled 999,999 USDT out in three transactions using multicalls.",
   "sourceUrl": "https://cointelegraph.com/news/trader-loses-1m-after-signing-phishing-token-approval",
   "url": "https://drains.watch/i/usdt-approval-phishing-999999-jul-2026"
  },
  {
   "incident": "address-poisoning-514k-usdt-jan-2026",
   "incidentTitle": "Ethereum user loses $514K in USDT to address poisoning two minutes after a test transfer",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-16",
   "title": "Around 14:01 UTC the victim sent a 5,000 USDT test and then 509,000 USDT to a lookalike address.",
   "sourceUrl": "https://cryptonews.net/news/security/32290951/",
   "url": "https://drains.watch/i/address-poisoning-514k-usdt-jan-2026"
  },
  {
   "incident": "address-poisoning-514k-usdt-jan-2026",
   "incidentTitle": "Ethereum user loses $514K in USDT to address poisoning two minutes after a test transfer",
   "severity": "high",
   "status": "closed",
   "threatStatus": "active",
   "date": "2026-01-16",
   "title": "Cyvers Alerts posted a warning about the theft at 14:34 UTC.",
   "sourceUrl": "https://cryptonews.net/news/security/32290951/",
   "url": "https://drains.watch/i/address-poisoning-514k-usdt-jan-2026"
  },
  {
   "incident": "address-poisoning-50m-usdt-dec-2025",
   "incidentTitle": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-20",
   "title": "At 03:06 UTC the victim sent a 50 USDT test to the intended address; a script then created a lookalike address and sent small transfers to poison the wallet's history.",
   "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return",
   "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025"
  },
  {
   "incident": "address-poisoning-50m-usdt-dec-2025",
   "incidentTitle": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-20",
   "title": "At 03:32 UTC the victim copied the lookalike address from history and sent 49,999,950 USDT to it.",
   "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return",
   "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025"
  },
  {
   "incident": "address-poisoning-50m-usdt-dec-2025",
   "incidentTitle": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-20",
   "title": "Within 30 minutes the USDT was swapped to DAI via MetaMask Swap, converted to about 16,690 ETH, and about 16,680 ETH was deposited into Tornado Cash.",
   "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return",
   "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025"
  },
  {
   "incident": "address-poisoning-50m-usdt-dec-2025",
   "incidentTitle": "Trader loses nearly $50M in USDT to address poisoning after copying a lookalike address from history",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "active",
   "date": "2025-12-20",
   "title": "The victim posted an on-chain message offering a $1M bounty for return of 98% of the funds and said a criminal case had been filed.",
   "sourceUrl": "https://www.theblock.co/post/383423/crypto-trader-loses-50-million-in-address-poisoning-attack-offers-1-million-bounty-for-return",
   "url": "https://drains.watch/i/address-poisoning-50m-usdt-dec-2025"
  },
  {
   "incident": "solana-address-poisoning-wave-2025-2026",
   "incidentTitle": "Address poisoning hit nearly 4.5M Solana wallets; 1,104 sent $940K to lookalike addresses",
   "severity": "critical",
   "status": "live",
   "threatStatus": "active",
   "date": "2025-11-17",
   "title": "A Solana wallet sent a $10 USDT test to its Gate.io deposit address; 12 seconds later a lookalike sent dust, and the wallet then sent 30,749.80 USDT to the lookalike.",
   "sourceUrl": "https://cryptoslate.com/?p=571247",
   "url": "https://drains.watch/i/solana-address-poisoning-wave-2025-2026"
  }
 ]
}