A crypto user reportedly lost about 100, 000 USDT after falling for an address poisoning attack, a scam that only needs a copied wallet string and a moment of bad judgment to do real damage.
- Loss: about 100, 000 USDT
- Method: poisoned transaction history
- Aftermath: funds moved into about 52.8 ETH
Cyvers Alerts said the fake address had been sitting in the victim’s transaction history for 66 days before the transfer was made. That matters, because address poisoning usually works by making a lookalike address seem familiar long before the victim ever needs it.
In plain English: a scammer gets a fake address into your recent history, then waits for you to copy it later without checking the full string. If you trust the wallet’s shortened display or skim the most recent entry, you can end up sending funds to the attacker instead of the intended recipient. Crypto, as usual, can be brutally honest about tiny mistakes.
Cyvers described the incident as a social-engineering attack, not a technical exploit of the wallet, blockchain, or token contract. That distinction matters. No private key had to be stolen, no smart contract had to be broken, and no magical “hack the chain” nonsense was required. The attacker simply manipulated the human on the other end of the screen.
According to Cyvers, the stolen USDT was then converted into about 52.8 ETH. That move makes sense from a thief’s perspective. USDT is a stablecoin issued by Tether, and Tether can block specific USDT addresses. Native ETH does not have an issuer with the same freezing ability, so swapping into ETH can make seizure harder, though the funds are still traceable on-chain and can be difficult to cash out cleanly.
That conversion does not make the loot invisible. It just removes one of the easiest points of intervention. Criminals are not geniuses, they are opportunists. If one asset can be frozen and another cannot, they usually pick the one that gives them fewer headaches. Shocking, I know.
Address poisoning works because many wallets and block explorers show only the first and last characters of an address. That’s convenient for ordinary use, but it also gives scammers a friendly little assist. A visually similar address can look legit enough when you’re moving fast, especially if it appears in your own transaction history.
Cyvers advised users to compare the complete character string of any destination address rather than trusting a shortened display or a familiar-looking record in history. That advice is boring, repetitive, and exactly the kind of thing that saves money. In crypto, boring is often just another word for “still solvent.”
The bigger lesson is that this kind of scam is cheap, scalable, and nasty. Scammers can send tiny “dust” transactions or otherwise pollute histories with lookalike addresses, then let the victim do the rest. The attack does not need to beat encryption. It just needs to beat habit, haste, and a UI that rewards clicking over verifying.
That’s why “I only copied it from my recent transactions” is not a defense. It’s the trap. A poisoned address can look like part of a normal workflow until the funds are gone and the blockchain does what blockchains do best, record the mistake forever.
There’s also a reason the USDT-to-ETH move gets so much attention. Stablecoins are useful precisely because they are tied to a central issuer, but that also means they can be blocked under the right conditions. Native ETH is harder for any issuer to interfere with because there is no issuer. That’s one reason attackers like to convert quickly once they get their hands on stolen stablecoins.
Still, “harder to freeze” is not the same as “safe.” Blockchain analytics firms and exchanges can still trace flows, flag suspicious activity, and in some cases freeze off-ramps when funds touch centralized services. Crypto thieves often buy themselves time, not freedom.
The prevention playbook is not glamorous, but it is the right one:
- Verify the full address every time, not just the first and last few characters.
- Confirm through a separate channel if you’re paying a new counterparty.
- Send a small test amount before moving larger sums.
- Use whitelists where your wallet or exchange offers them.
- Consider a hardware wallet so the transaction details are checked on a physical device before signing.
Test transactions help, but they are not a magic shield. They reduce risk, yet they won’t save you if you later copy the wrong address from history or approve the wrong destination out of habit. There is no button in crypto labeled “undo.” If there were, every scammer would already be lobbying to delete it.
The tools themselves also deserve scrutiny. A March report found that Etherscan hid zero-value transfers by default, while BscScan and Basescan required users to enable a “hide 0 amount tx” option. That kind of inconsistency matters because tiny transfers are part of how scammers clutter histories and make poisoned entries look routine. The interface choices might look minor, but minor is exactly how these scams survive.
Former Binance CEO Changpeng Zhao also criticized transaction explorers that kept displaying malicious entries. The complaint is fair. If explorers and wallet tools make spam easier to browse, they can also make it easier to get robbed. Convenience is great until it becomes camouflage for fraud.
The policy response is starting to catch up, at least on paper. Senators Elissa Slotkin and Jerry Moran introduced the SAFE Crypto Act, short for the Strengthening Agency Frameworks for Enforcement of Cryptocurrency Act. The proposal would create a federal task force focused on identifying, monitoring, and preventing cryptocurrency scams.
The task force would bring together the Department of Treasury, law enforcement, digital-asset companies, stablecoin issuers, blockchain intelligence firms, consumer-protection organizations, and state bank regulators. The idea is simple: crypto fraud is messy, cross-border, and highly technical, so the response has to be coordinated instead of stitched together after the fact.
The bill also calls for an update within a year and annual reports, which is at least more concrete than the usual politician-grade theater. Still, this is a coordination framework, not a magic shield. It is designed to help identify and disrupt scams, not refund every user who fat-fingers an irreversible transfer.
That distinction is the whole game. Crypto gives people control over their money, and that control cuts both ways. It protects against censorship and custodial abuse. It also means a bad paste, a rushed approval, or a copied address from the wrong place can become an expensive, permanent lesson.
Key takeaways
-
What is an address poisoning attack?
It is a scam where a fake or lookalike wallet address is inserted into transaction history so a victim later copies the wrong destination. For a deeper breakdown, see What Are Address Poisoning Attacks in Crypto and How to. -
Why was the stolen USDT converted into ETH?
Stablecoins like USDT can be blocked by the issuer at specific addresses, while native ETH does not have an issuer with the same freezing power. -
Does a test transfer fully protect against this scam?
No. A test send helps, but it does not stop someone from later copying a poisoned address or trusting the wrong history entry. -
What does the SAFE Crypto Act do?
It is a proposed bill that would create a federal task force to coordinate anti-fraud efforts across government and industry. It does not create a reimbursement program. -
What is the simplest defense?
Check the full address every time and confirm it through a separate channel before sending meaningful funds.
Crypto still offers something the legacy system never really did: direct ownership without asking a bank for permission. That is the good side, and it matters. But the dark side is just as real, and scams like address poisoning prove that bad UX, bad habits, and a little patience from criminals can be enough to drain a wallet without breaking the underlying tech.
That broader tension between open systems and bad actors is nothing new in cryptocurrency and crime. The tech does not disappear just because scammers show up; it forces users, exchanges, and policymakers to get serious about security instead of pretending every shiny wallet is idiot-proof. It isn’t. Never was.
And when the stakes are bigger, the same dynamics apply at scale. The US Treasury Seizes Nearly $1 Billion in Iran-Linked Crypto crackdown showed how state power and stablecoin issuer controls can collide, while Tether Faces $344M USDT Seizure Lawsuit Over IRGC-Linked and Tether Freezes $514M in USDT as Tron Becomes Blacklist underscore the uncomfortable reality: centralized stablecoins can be a blessing for compliance and a curse for anyone who thinks “decentralized” is a universal feature of crypto.
Meanwhile, if you want a random palate cleanser from the fraud wars, there’s always Understanding the Rise of Electric Vehicles in 2023. Not exactly a wallet-security guide, but hey, at least EVs won’t drain your USDT if you click the wrong link.
Further reading
A few more angles on address poisoning, wallet hygiene, and the messier side of crypto security:
