In the world of cryptocurrency, where transactions are irreversible, mistakes can cost a fortune. Recently, on December 2, 2025, a user lost over $1.1 million in USDT stablecoin, falling victim to a sophisticated attack known as „address poisoning”. The incident quickly spread across social media, including the platform X (formerly Twitter), where users shared warnings and analyses. Let’s take a closer look at the incident, the mechanism of the attack, and ways to avoid similar traps.
What exactly happened?
According to information shared by the account @web3_antivirus on X, the attack began with a small „dust” transaction worth just $0.0015. The scammer sent this symbolic amount to the victim’s wallet to insert a fake address into the transaction history. Just eight minutes later, the victim – likely copying the address from the history instead of verifying it manually – sent 1,099,516.02 USDT (equivalent to about $1.1 million) to the scammer’s account.
The transaction was recorded on the Ethereum blockchain. The recipient of the USDT tokens turned out to be a fake wallet: 0xec6d9b6bf7a9b2e1d74. Importantly, the fake address was deliberately constructed to resemble the real one – with similar starting and ending characters, which makes it easy to mistake it during a quick check.
A post on X by @kkashi_yt illustrated the difference between the addresses, highlighting how easily one can make a mistake. The user lost the funds within a few minutes, and the return on investment (ROI) for the scammer amounted to an astronomical 733,000,000x – all thanks to the clever use of psychology and blockchain mechanisms.
What is address poisoning?
Address poisoning, also known as „zatruwanie adresu”, is a type of cryptocurrency scam in which the attacker creates a wallet address similar to the victim’s address or that of their frequent counterparties. The scammer monitors the victim’s transactions, then generates an address with identical starting and ending characters (e.g. the first 4-5 and last 4-5 characters). Next, they send a small, inconspicuous transaction (so-called dust tx), which appears in the victim’s wallet history.
When the victim wants to send funds, they often copy the address from the transaction history instead of entering it manually. If they do not check the entire string of characters, they may copy the fake address and send funds directly to the scammer. These attacks are especially common on blockchains such as Ethereum or TRON, where transactions are public and easy to track. Unlike phishing, address poisoning does not require interaction with fake websites – it only takes a moment of user carelessness.
Research shows that such attacks are becoming more frequent, especially during periods of crypto market growth, when users act under time pressure. Companies such as Chainalysis and Trezor regularly warn against them, emphasizing that the key to security is verifying the full address.
How to avoid address poisoning?
To avoid falling victim to a similar attack, it is worth following a few simple rules:
- Always verify the full address: Don’t rely on shortcuts – check the entire string of characters before sending funds.
- Use security tools: Browser extensions such as Web3 Antivirus or hardware wallets (e.g. Trezor, Ledger and others) can detect suspicious transactions and addresses.
- Send test transactions: Before sending a large amount, transfer a small sum and confirm that it arrives.
- Avoid copying from history: Always enter the address manually or use trusted bookmarks.
- Educate yourself: Follow reliable sources to stay up to date with new threats.
In the age of cryptocurrency, security depends primarily on the user. This incident is a painful reminder that haste and carelessness can cost millions. If you make cryptocurrency transactions, remember: it is better to check twice than to regret once.
