Address Poisoning Attack Hack

On December 20, 2025, a victim lost approximately $50 million USDT through an address poisoning attack after testing a 50 USDT transfer to legitimate address 0xbaf4b1aF…95F8b5, then mistakenly copying a poisoned address 0xBaFF2F13…08f8b5 with identical initial and ending characters from their transaction history, subsequently sending 49,999,950 USDT to the attacker's address.

The attacker employed an address poisoning technique where they monitored the victim's test transaction of 50 USDT to the legitimate address and immediately created a false transfer log using fake USDT tokens to a vanity address that matched the first and last characters of the legitimate recipient's address. This poisoned address appeared in the victim's transaction history, and when the victim later needed to send the full amount, they copied what they believed was the correct address from their recent transactions without verifying the complete address string. The attack exploited human error and transaction history reliance rather than any smart contract vulnerability.

Within moments of receiving the 50M USDT, the attacker executed a series of swaps converting USDT to DAI, then DAI to ETH, before routing the funds through Tornado Cash mixer to obscure the trail.

Exploit Transaction:

0xc0514a79…d86a0f