Address poisoning attack: how a scammer stole 50 million USDT with a single click

Anatomy of a Scam: From Transaction History to Disaster

The cryptocurrency ecosystem recently experienced one of the most surprising attacks in recent years. A user who actively managed their wallet for nearly two years and primarily specialized in USDT transfers made a withdrawal of approximately $50 million from a trading platform. After receiving the funds, they performed a procedure that most consider safe — first sending a small test amount.

A few minutes later, they proceeded with the main transfer. At this point, they fell victim to an attack known as “address poisoning” (zatrucie adresu). The scammer had previously prepared a wallet with an address very similar to the victim’s and sent a symbolic amount of USDT to it. This transfer appeared in the victim’s transaction history.

Because blockchain addresses are displayed as long, complex strings of characters, the user, when copying an address from previous transactions — a process that can be described as foreach through a list of known counterparties — unknowingly copied this fake address. The result was devastating: nearly $50 million in USDT was transferred to the attacker’s account.

Threat Mechanics: Why Transaction History Became a Weapon

What makes this attack particularly dangerous is the simple scheme of its operation. Most wallets display the history of previous transfers for quick access. Effective users usually refer to previous addresses instead of typing them manually. Scammers are aware of this and exploit this human behavior.

The attacker did not need to interfere with any protocol or smart contract. A regular wallet, a minimal transfer, and waiting for the moment when the victim is in a hurry or insufficiently cautious were enough.

Industry Reactions and Lessons for the Future

The incident prompted a swift response within the industry. Leading wallet software providers issued security updates warning users against reflexively copying addresses and redesigned verification interfaces. Transaction confirmation screens have become more advanced, requiring greater attention from users.

The lesson is clear: security in blockchain is not only a matter of technology but primarily of interface design and user education. Wallets must be designed in a way that makes such errors difficult, and users must understand that a single click can have irreversible consequences.