Investor Defrauded of $50K in Ethereum Address Poisoning Scheme

Cryptocurrency Investor Loses $50,000 to Address-Poisoning Scam

A cryptocurrency investor has reported a staggering loss of around $50,000 in USDT due to an address-poisoning scam on the Ethereum network, as detailed by Scam Sniffer. This attack involved a fraudulent address that closely mimicked the legitimate recipient’s address, matching the first four and last six characters. Scam Sniffer provided crucial evidence, including a screenshot of the transaction history alongside both the genuine and fraudulent addresses.

Understanding Address Poisoning

MetaMask, a prominent wallet provider, elaborates on this deceptive practice in its security guidelines. Address poisoning works by inserting a fraudulent address into a user’s transaction history, allowing scammers to monitor token transfers, mostly focusing on stablecoins. The attackers often commence this scheme with either a minuscule or zero-value transaction to embed their address into the victim's activity record. When the victim later attempts to send funds, they may inadvertently copy the similar-looking fraudulent address instead of the correct one.

Notable Incidents

In a notable incident on August 11, a user fell victim to a similar scheme, losing about 100,000 USDT after mistakenly selecting a fraudulent address that had been placed in their wallet’s history 66 days earlier. Reports from Cyvers Alerts suggested that the victim had relied solely on the historical record without closely scrutinizing the entire address. After executing the payment, the attacker promptly exchanged the stolen USDT for ETH, leaving the receiving wallet with approximately 52.8 ETH at the time of the alert.

Cyvers branded this incident a case of social engineering underscored by a forged address, and the initial report did not specify if any recovery efforts had been made. They emphasized the importance of thoroughly checking the full address and warned users against viewing transaction histories as secure reference resources. This particular scam seemed carefully designed to mitigate the risk of the stolen stablecoins being frozen post-theft.

In another incident reported on December 21, 2025, a trader lost an immense amount of 49,999,950 USDT when they mistakenly sent a large sum to a fake address after initially testing it with a trivial 50 USDT transfer. The attacker had already infiltrated the victim's history with a minuscule 0.005 USDT transaction, cleverly matching the first three and last four characters of the legitimate address, leading the user to inadvertently copy it.

Funds from this larger transaction were soon converted into ETH, distributed across various wallets, and partly laundered through Tornado Cash. In a twist of desperation, the victim issued a $1 million bounty, demanding a significant portion of their stolen funds back within a 48-hour window via on-chain messaging.

Preventive Measures and Industry Response

MetaMask has implemented measures designed to alert users about potential dangers when transferring funds to destinations that have a resemblance to previously used addresses, displaying a warning when such similarities occur. Their guidelines emphasize the necessity of saving verified addresses in contacts to avoid falling prey to this type of fraud.

In early March 2023, Binance’s co-founder, Changpeng Zhao, criticized the proliferation of transaction-history spam, sparked by a user named Nima who received 89 suspected address-poisoning emails within a short span following two stablecoin transactions on Ethereum. Zhao urged blockchain explorers to enhance their filtering systems to eliminate such malicious entries.

Additionally, in June 2024, Ledger issued a cautionary notice about misleading transactions aimed at tricking users into believing they had previously sent funds to a malicious address. The alert covered how imitation addresses could intentionally replicate parts of a legitimate destination, posing risks to unsuspecting users.