A crypto user lost $50 million in USDT after falling for an address poisoning scam in a massive onchain exploit.
The theft, discovered by Web3 security firm Web3 Antivirus, happened after the user sent a $50 test transaction to confirm the destination address before transferring the rest of the funds.
Loading…
Within minutes, a fraudster created a wallet address similar to the destination, matching the first and last characters, knowing that most wallets shorten addresses and only display prefixes and suffixes.
The scammer then sent the victim a small amount of “dust” to poison their transaction history. Apparently thinking the destination address was legitimate and entered correctly, the victim copied the address from their transaction history and ended up sending $49,999,950 USDT to the fraudster’s address.
These small dust transactions are often sent to addresses with large holdings, poisoning transaction histories in an attempt to trap users in copy-paste errors like this one. The bots that carry out these transactions cast a wide net in hopes of success, which they achieved in this case.
Blockchain data shows that the stolen funds were then exchanged for ether and moved across several wallets. Several involved addresses have since interacted with Tornado Cash, a sanctioned crypto mixer, in an attempt to obscure the transaction trail.
In response, the victim published an onchain message demanding the return of 98% of the stolen funds within 48 hours. The message, backed by legal threats, offered the attacker $1 million as a reward if the assets are returned in full.
Failure to comply, the notice warns, will trigger legal escalation and criminal charges.
“This is your last opportunity to resolve this matter peacefully,” the victim wrote in the message. “If you fail to comply: We will escalate the matter through legal international law enforcement channels.”
Address poisoning does not exploit any vulnerabilities in code or cryptography, but instead exploits user habits, namely the reliance on partial address matching and copy-pasting from transaction history.
