Address Poisoning Attack

What happened

On December 20, 2025, a victim lost almost $50M in USDT after copying a poisoned lookalike address from transaction history.

This was pure human-interface exploitation. The attacker exploited how people rely on recent transaction history and glance at the first and last few characters of an address instead of verifying the whole thing. After the victim sent a small test amount, the poisoned address appeared in their history and the main transfer followed. The attacker then started laundering almost immediately through stablecoin swaps and Tornado.