On December 20, 2025, on-chain analytics firm Lookonchain reported that a cryptocurrency user fell victim to a sophisticated address poisoning attack, accidentally transferring approximately $50 million in USDT to a scammer’s wallet due to a simple copy-paste error from their transaction history.
The incident unfolded when the victim, preparing for a large transfer, first sent a small test amount of 50 USDT to their own wallet address (starting with 0xbaf4… and ending with …B6495F8b5) as a precautionary measure—a common practice to verify addresses. Scammers, closely monitoring the wallet, quickly created and used a vanity address mimicking the first and last four characters of the legitimate one (0xBaFF…f8b5). They then sent small “dust” transactions to poison the victim’s transaction history, making the fake address appear prominently.
Believing they were copying the correct address from recent history, the user pasted the poisoned one and executed the massive transfer. The funds were immediately moved by the scammer, who converted much of it to DAI to evade potential freezes by Tether. This type of scam exploits user habits and the fact that most wallets display only abbreviated addresses, without compromising private keys or hacking the wallet itself.
Address poisoning attacks have surged in sophistication throughout 2025, preying on high-value wallets and highlighting the irreversible nature of blockchain transactions. Security experts urge users to always manually verify full addresses, use wallet address books for frequent recipients, and avoid copying from transaction history.
This loss ranks among the largest single-victim scams of the year, serving as a stark reminder of non-technical risks in crypto handling.
For ongoing updates on crypto scams, security best practices, and related developments, viewers are encouraged to visit www.token10x.com and www.token10x.blog. Our websites provide comprehensive coverage and real-time insights into this evolving story.