TLDR
About $50 million in USDT was stolen today in a single address poisoning incident, one of the years largest on?chain scam losses reported by multiple outlets.
- Exact transfer was 49,999,950 USDT to a spoofed look?alike address per a detailed report here.
- The method was an address poisoning scam that exploits copy?paste and truncated address displays covered in depth.
- Stolen funds were swapped into DAI and ETH and partially sent through Tornado Cash, reducing recovery odds as summarized.
Deep Dive
1. Amount
Reports converge on a single transfer of 49,999,950 USDT, rounded to about $50 million, leaving the victims wallet within minutes of an initial test send, making it one of the largest on?chain scam losses this year reported by multiple outlets. Coverage notes the theft unfolded in under an hour from receipt of funds, highlighting how quickly a simple operational error can escalate at size as summarized.
The number is not an estimate. It reflects a single, confirmed transfer amount observed on chain and widely reported.
2. Method
This was an address poisoning attack. A scammer seeded the victims transaction history with a look?alike address that shared the same first and last characters as the intended recipient. The victim later copied that poisoned entry and sent the funds to the attacker, a pattern explained in detail in coverage of the incident here.
The failure wasnt a protocol hack. It exploited human behavior plus wallet UX conventions that truncate the middle of addresses. Verifying the full address string reduces this risk.
3. Fund Movement
To avoid freezes, the attacker reportedly swapped USDT to DAI, then converted to ETH and dispersed funds across wallets, with part of the flow passing through Tornado Cash, which complicates tracing and recovery as summarized. Follow?ups also note an on?chain message offering a white?hat bounty for returning most of the funds, but there was no confirmation of recovery at the time of reporting outlined here.
Once stablecoins are swapped and mixed into ETH, practical recovery odds fall sharply, especially without rapid freezing and coordination.
Conclusion
Roughly $50 million USDT was lost in a single address poisoning transfer. The key driver was a copy?paste to a look?alike address seeded in the wallet history, and the rapid conversion to DAI and ETH with mixing makes recovery unlikely based on the reports above. The actionable takeaway is operational: verify full addresses end to end and avoid relying on truncated history entries when moving significant sums.
CoinsKid.Com