What scam drained USDT funds?

TLDR

It was an address spoofing scam: a victim copied a lookalike wallet address from recent transactions and sent nearly $50 million in USDT to the attackers address, per a reported incident on 20 Dec (address spoofing report).

1. The victim first tested the correct address, then sent $50M to a spoofed address with similar first and last characters, according to the report above.
2. This pattern is commonly called address poisoning or spoofing, where attackers plant similar addresses in your history to trick copy?paste behavior.
3. This was not an approval drainer exploit. It was a misdirected transfer caused by lookalike addresses, as described in the report above.

Deep Dive

1. What Happened

A user lost about $50 million in USDT after copying a spoofed wallet address from their transaction history and pasting it into a transfer, sending funds to an attackers lookalike address instead of the intended recipient (address spoofing report).

The report notes the spoofed address shared the same first three and last four characters as the intended one, making a quick visual check insufficient. The sequence included a small test to the correct address, followed minutes later by the full transfer to the spoofed address, which is a known pattern in address-spoofing attacks.

2. How Address Spoofing Works

Attackers generate vanity addresses that resemble a targets intended destination and seed those addresses into a victims transaction history or communications, hoping the victim copies the wrong one. The cited incident matches that pattern, with near?matching prefixes and suffixes leading to a misdirected transfer (address spoofing report).

In practice, this is different from malware or contract drainers. There is no approval theft or code exploit. The funds move because the sender signed a legitimate transfer to the wrong address.

3. Approval Drainers vs Spoofing

Approval drainers typically trick users into signing token approvals that let a malicious contract pull funds later. Here, the transfer was a one?time send to a wrong address, not a pull via approvals, as indicated in the report above (address spoofing report).

Understanding the difference matters. Spoofing defeats quick visual checks and casual copy?paste habits. Approval drainers, in contrast, hinge on deceptive signing flows and malicious permissions.

Conclusion

The USDT loss came from an address spoofing scam, not an approval drainer. The attacker leveraged a lookalike address in the victims history, leading to a misdirected transfer as detailed in the report above. The practical takeaway is to verify full destination details rather than relying on first and last characters, since lookalike addresses can defeat quick visual checks.