Address Poisoning Attack Hack

Reported loss $50.0M
Phishing

What happened

On December 20, 2025, a crypto trader sent 49,999,950 USDT to a scammer-controlled lookalike address after an address-poisoning campaign inserted it into the victim's transaction history. The attacker converted the USDT to DAI and ETH, and reportedly routed about 16,680 ETH through Tornado Cash. The victim offered a $1 million bounty for return of 98% of the funds.

How it happened

  1. The victim sent a 50 USDT test transfer to the intended destination.
  2. An attacker generated a spoofed address matching the intended address's first five and last four characters, then sent small transactions from it to poison the victim's history.
  3. The victim copied the lookalike address from transaction history and sent 49,999,950 USDT to it.
  4. The attacker converted the proceeds to DAI and ETH and routed ETH through Tornado Cash.

Protocol details

Classification Other
Protocol Type Exploit/Phishing

Evidence

Understand the attack patterns

Compare incidents →
Phishing Attacks

Same attack technique

Browse all hacks →
USDC Permit Signature Phishing $1.8M lost Social Engineering Scam $282M lost Venus $13.0M lost Phishing $91.0M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes