Address Poisoning: The $50M Lost to One Copy-Paste

At 14:41 UTC on 19 December 2025, 49,999,950 USDT landed in a crypto wallet that had been in use for about two years. The money came from Binance, the world's largest crypto exchange, which works much like an online stockbroker. USDT is a stablecoin, a digital dollar issued by a company called Tether, so the balance was worth almost exactly $50 million. The owner was moving it somewhere of their own.

The owner did what careful people are told to do. At 15:06 they sent a test payment of 50 USDT to the destination, an address beginning 0xbaf4b1 and ending F8b5. It arrived. At 15:32 they sent the other 49,999,950 USDT. It went to a different address, one beginning 0xBaFF2F and ending f8b5. Nothing was hacked. The owner copied the wrong line from their own payment history.

It is one of the largest address poisoning losses on record. The thief held the money for 28 minutes before converting it into something that could not be frozen. A $1 million reward offered for its return went unanswered, and nine months later none of it has come back.

What happened in the 26 minutes

Every payment on Ethereum, the blockchain USDT was using, is public the moment it happens. Automated programs watch for one pattern in particular: a small payment to a new address from a wallet holding a large balance. A test payment is a signal that a big payment is coming, and it tells the watcher exactly where.

The blockchain record shows what followed. At 15:10, four minutes after the test, a transfer of zero USDT appeared in the victim's history, recorded as if the victim had sent it to 0xBaFF2F...f8b5. USDT's code allows anyone to trigger a zero-value transfer on someone else's behalf, and the record looks like the owner made it. At 15:12, a counterfeit token whose name was spelled to read "Tether USD", using look-alike letters and hidden characters, logged a transfer of 50 "USDT" from the victim to the same fake address: a mirror image of the real test payment. At 15:20, the fake address sent the victim 0.005 USDT, half a cent.

Each entry put the look-alike at the top of the victim's recent activity. A rival scammer was working the same wallet with an even closer match, 0xbAF4b192...D1f8B5, whose first six characters were identical to the real ones. The victim copied one of the poisoned entries, pasted it, and sent the $50 million.

©CMZ graphic. Data: Ethereum blockchain

Blockchain tracker Lookonchain, security firm SlowMist and the investigator Web3 Antivirus flagged the theft within hours. By then the money was already moving.

The getaway

Tether can freeze USDT held in a wallet that police or investigators flag, which is the closest thing crypto has to a bank stopping a payment. At 16:01, the thief used the swap service built into MetaMask, a popular wallet app, to exchange the entire 49,999,950 USDT for 49,533,438 DAI. DAI is a stablecoin with no company behind it that can freeze balances. Paying roughly $466,000 in price slippage for speed was, from the thief's side, a bargain.

The DAI was then swapped for about 16,690 ether (ETH), and around 16,680 ETH went into Tornado Cash. Tornado Cash is a mixer: everyone's coins go into one pool and come out as different coins, much like pouring banknotes into a shared bin and drawing out the same amount in other notes. The US Treasury sanctioned it in 2022 and lifted the sanctions in March 2025.

At 08:00 UTC on 20 December, the victim wrote a message into a blockchain transaction addressed to the thief. It said "We have officially filed a criminal case", listed six addresses under "24/7 surveillance", and demanded 98% of the money back within 48 hours. The thief could keep $1,000,000 as a "white-hat bounty", the reward normally paid to ethical hackers who return funds. The deadline passed. No reply was made public, no return has shown up on the victim's wallet, and the victim has never been named.

How the trick works

A crypto address is an account number 42 characters long: "0x" followed by 40 letters and digits. Nobody reads them in full. Wallet apps and block explorers, the public websites that display blockchain records, usually shorten them to the first and last few characters, the way a bank card shows only its last four digits.

The scam runs in four steps. First, the scammer picks a target and an address the target pays often. Second, a computer generates new addresses at high speed until one matches the ends of the real one. Matching three characters at the front and four at the back, as in this case, takes little computing power. Third, the scammer plants the look-alike in the victim's payment history with a tiny payment, a zero-value transfer or a fake token. Fourth, the scammer waits for the victim to copy "the address I used last time".

The banking equivalent would be a fraudster slipping a new entry into the recent-payees list of someone's online banking, with the same payee name and a different account number. A bank would not allow it. A blockchain lets anyone do it for a fraction of a cent.

It is cheap. Researchers at Carnegie Mellon University found that a May 2024 poisoning which netted about $68 million cost the scammer $0.65 in network fees.

How common it is

The Carnegie Mellon study, led by Taro Tsuchiya and Nicolas Christin and presented at the USENIX Security Symposium in 2025, counted about 270 million poisoning attempts against 17 million targeted wallets on Ethereum and BNB Smart Chain between July 2022 and June 2024, with at least $83.8 million in confirmed losses. Roughly one attempt in 10,000 worked. That was enough for organised groups to earn 10 to 20 times their costs.

It became cheaper still. Ethereum's Fusaka upgrade on 3 December 2025 cut transaction fees, and Coin Metrics found that stablecoin "dust", payments too small to have any purpose except seeding wallet histories, rose to about 11% of all Ethereum transactions, up from 3 to 5% before the upgrade. Of 227 million USDT and USDC balance changes it studied from November 2025 to January 2026, 38% were worth less than one cent. The security firm Blockaid counted 628,000 poisoning transactions in November 2025 and 3.4 million in January 2026.

The large cases keep coming. On 3 May 2024 a holder sent 1,155 wrapped bitcoin (WBTC), a token on Ethereum that tracks the bitcoin price, to a poisoned address. It was worth about $68 million. That thief returned nearly all of it by 12 May, after SlowMist published analysis linking the attacker to Hong Kong internet addresses and negotiators from Match Systems and the exchange Cryptex got involved. On 30 January 2026, according to Scam Sniffer, another holder sent 4,556 ETH, about $12.25 million, to 0x6d9052...2e48 instead of an over-the-counter trading desk's deposit address, 0x6D90CC...2E48. On 21 August 2026, PeckShield reported that the trading firm Bofur Capital had sent 2 million USDC to a look-alike after withdrawing from the lending platform Compound. No return has been reported in either case.

©CMZ chart. Data: Chainalysis, CoinDesk, Scam Sniffer, PeckShield

How to avoid it

The defences are unglamorous. Security firms, wallet makers and the Carnegie Mellon researchers give the same list.

Verified addresses belong in the wallet's address book, the equivalent of saved payees, and payments should go only from there. An address should never be copied from transaction history. The whole address needs checking, especially the middle characters that wallets hide. After a test payment, the safe routine is to confirm arrival with the recipient through a separate channel, then paste the address again from the original source rather than from the history. Any unexpected tiny or zero-value incoming transfer is a warning: it means someone has picked the wallet as a target.

Changpeng Zhao, the founder of Binance, called on 24 December 2025 for every wallet to check addresses against shared blacklists and block known poison addresses by default. He said Binance had catalogued about 15 million of them. Etherscan, the most widely used Ethereum block explorer, now labels the address that took the $50 million "Fake_Phishing1691332" and warns visitors that it was reported for address poisoning. The warning arrived after the money had gone.