USDT holder loses $50K in Ethereum address-poisoning attack

A cryptocurrency user has lost approximately $50,000 in USDT to an address-poisoning attack on Ethereum, according to Scam Sniffer.

Summary

• A user lost approximately $50,000 in USDT on Ethereum, according to Scam Sniffer.
• The fraudulent address matched the intended recipient's first four and last six characters.
• An earlier victim lost 100,000 USDT after an address remained planted for 66 days.
• MetaMask says it displays a blocking warning when a destination resembles a previously used address.

Scam Sniffer said the fraudulent address matched the intended recipient's first four and last six characters. The security platform shared the two addresses alongside a transaction-history screenshot showing the misdirected payment.

Address poisoning exploits familiar-looking payment records

In its security guidance, MetaMask describes address poisoning as a scam that places a lookalike address in a user's transaction history. Attackers monitor token transfers, often involving stablecoins, then generate an address resembling one the target has used.

According to the wallet provider, a negligible-value or zero-token transfer can put the imitation into the target's activity record. The attacker waits for the user to copy the wrong destination when preparing a later payment.

MetaMask explains that shortened address displays can conceal the difference: the opening and closing characters look familiar while the middle of the address differs.

Earlier USDT thefts involved planted addresses and test transfers

In an Aug. 11 case, crypto.news previously reported that a user lost approximately 100,000 USDT after selecting an imitation address planted in the wallet's history 66 days earlier, according to Cyvers Alerts.

Cyvers said the victim relied on the historical record without comparing the entire destination. After receiving the payment, the attacker exchanged the USDT for ETH, with the receiving wallet holding approximately 52.8 ETH when the security company published its alert.

The company described the incident as social engineering involving a forged address record. Its initial account did not identify the victim or report a recovery, return agreement, or exchange intervention. Cyvers attributed the loss to the failure to check the full address and advised against treating transaction history as a trusted address book. The security company said the conversion appeared intended to reduce the risk of the stablecoins being frozen.

A separate case covered on Dec. 21, 2025, involved a trader who transferred 49,999,950 USDT to a fraudulent destination after first sending a 50 USDT test payment to the intended recipient.

According to that account, the attacker inserted a 0.005 USDT dust transaction into the victim's history before the larger payment. The imitation matched the legitimate destination's first three and last four characters, and the victim copied it when preparing the remaining transfer.

SlowMist monitoring cited in the coverage said the funds were converted into ETH, distributed across wallets and partially moved through Tornado Cash. The victim subsequently offered a $1 million bounty and demanded the return of 98% of the funds within 48 hours through an on-chain message.

MetaMask documents warnings before funds are sent

MetaMask says its wallet compares a proposed destination with addresses in the sender's transaction history. If a new destination closely resembles a previously used address, the software displays a blocking warning before submission.

Its documentation gives the example of matching the first and last four characters with different characters in the middle. A separate warning appears when users send funds to an address they have never interacted with, although the provider says an unfamiliar destination is not necessarily malicious.

MetaMask recommends saving verified destinations in Contacts.

Explorer filtering has drawn scrutiny over poisoned records

On March 14, Binance co-founder Changpeng Zhao criticized transaction-history spam after a user identified as Nima reported receiving 89 address-poisoning emails in less than 30 minutes following two stablecoin transfers on Ethereum.

Zhao said Trust Wallet already filtered the transactions and called on blockchain explorers to remove malicious entries. The report included a clarification from a user identified as Xeift that Etherscan hid zero-value transfers by default, while BscScan and Basescan required users to activate a "hide 0 amount tx" control.

Nima warned, "So many will fall victim to this," according to the coverage. The reported messages documented repeated poisoning attempts; they were not described as 89 completed thefts. Etherscan issued a warning about the method, explaining that attackers try to persuade users to copy similar-looking destinations from transaction history.

Zhao acknowledged that filtering could affect small payments between AI agents and suggested using AI to distinguish legitimate transfers from spam.

In June 2024, Ledger warned about dummy transactions designed to make users believe they had previously sent funds to an attacker's address. Its warning described imitation addresses sharing the first four or five and last four or five characters of a legitimate destination.

Ledger said an unsolicited entry would not itself transfer value out of the recipient's account. An outgoing payment would require the user to initiate and sign a transaction with the device. The company advised users to hide unwanted tokens and NFTs in the wallet interface and avoid interacting with suspicious assets or their associated addresses.

Ledger's warning covered small cryptocurrency deposits and NFTs disguised as vouchers, which could lead users to send assets back to a scam account.

According to Ledger's June 2024 guidance, users could remove an unsolicited asset from view by right-clicking it and choosing the option to hide the token or NFT collection.