Incident Overview
On December 20, 2025, a victim lost approximately $50 million USDT through an address poisoning attack after testing a 50 USDT transfer to legitimate address 0xbaf4b1aF…95F8b5, then mistakenly copying a poisoned address 0xBaFF2F13…08f8b5 with identical initial and ending characters from their transaction history, subsequently sending 49,999,950 USDT to the attacker's address.
The attacker employed an address poisoning technique where they monitored the victim's test transaction of 50 USDT to the legitimate address and immediately created a false transfer log using fake USDT tokens to a vanity address that matched the first and last characters of the legitimate recipient's address. This poisoned address appeared in the victim's transaction history, and when the victim later needed to send the full amount, they copied what they believed was the correct address from their recent transactions without verifying the complete address string. The attack exploited human error and transaction history reliance rather than any smart contract vulnerability.
Within moments of receiving the 50M USDT, the attacker executed a series of swaps converting USDT to DAI, then DAI to ETH, before routing the funds through Tornado Cash mixer to obscure the trail.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Address Poisoning Attack, these are the critical security checks that could have prevented this incident (December 2025).
- Verify all logic paths related to Phishing are guarded by proper access controls and input validation - see the Phishing Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next Address Poisoning Attack
The Address Poisoning Attack hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.