TLDR
About $50 million in Tether (USDT) was lost this week in a single address?poisoning scam, reported as 49,999,950 USDT sent to a spoofed address in one transfer (incident summary).
- Exact loss: 49,999,950 USDT in one mistaken transaction (report).
- The attacker used a look?alike address matching the first 3 and last 4 characters (coverage).
- Funds were quickly swapped (DAI, then ETH) and partly sent through Tornado Cash to evade freezing (details).
Deep Dive
1. Scale Of Loss
A single user lost 49,999,950 USDT (about $50 million) to an address?poisoning scam on 20 Dec (UTC), one of the largest on?chain losses this year (incident recap).
- Multiple outlets confirm the amount and mechanism (copying a poisoned address from wallet history), with on?chain investigators tracking post?theft flows (summary).
- The victims wallet showed typical USDT activity and had just withdrawn funds from an exchange before the mistake (story).
This wasnt a protocol hack. It was a single operational error with a very large dollar footprint, so behavioral safeguards matter as much as code security.
2. How Address Poisoning Works
Attackers insert a look?alike address into your recent transactions (often via tiny transfers), then rely on you copying it later. In this case, the fake address matched the first three and last four characters, exploiting truncated displays (mechanics).
- A small test send occurred first, which likely alerted automated scripts monitoring the wallet (analysis).
- Minutes later, the full transfer was copied to the spoofed address from the history instead of the intended one (overview).
Copy?pasting from wallet history is risky. Verifying the full address (not just the first/last characters) and using trusted address books can reduce exposure.
3. Why USDT And Post?Theft Flows
USDT can be frozen by the issuer, so attackers often swap quickly into assets without centralized freeze controls. Here, stolen USDT was swapped to DAI and then into ETH, with partial mixing through Tornado Cash (flow details).
- Quick asset rotation and mixing hinder freezing and recovery actions, compressing the window for incident response (incident recap above).
- Risk note: wallet UIs that abbreviate addresses create human?layer vulnerabilities attackers exploit at scale (mechanics above).
Even with stablecoin freeze tools, speed and obfuscation can outpace response. Operational hygiene (allowlists, full?address checks, sender name?tagging) is the practical defense.
Conclusion
The loss was roughly $50 million USDT from a single copy?paste error into a poisoned address. The mechanism is simple, human?targeted, and effective, with rapid asset swapping reducing recovery chances. The practical implication is to harden user?level processes: verify complete addresses, maintain trusted address books, and avoid copying from wallet history for large transfers.
CoinsKid.Com