What caused the USDT address poisoning?

TLDR

USDT address poisoning was caused by a look-alike wallet address inserted into a victims transaction history, leading to a copy-paste mistake during a large transfer.

1. Attackers sent dust from a spoofed address, the victim copied it and sent about $50M USDT to the scammers wallet per a news report.
2. The spoof matched the first and last characters; wallet UIs truncate the middle, hiding differences as noted in a security write-up.
3. The stolen funds were quickly swapped to DAI, then ETH, and routed via Tornado Cash to avoid freezing, per a market update.

Deep Dive

1. Poisoning Flow

This was a social engineering attack, not a chain vulnerability. Attackers sent a tiny dust transfer from a look-alike address so it appeared in the victims transaction history.

When the victim prepared the main transfer, they copied that poisoned address from history and sent $49,999,950 USDT to the attacker per an onchain analysis.

2. UI Truncation Exploit

The spoofed address matched the same prefix and suffix as the real destination. Many wallets abbreviate addresses, showing only the beginning and end, which hid the middle-character differences highlighted in a security report.

This tactic exploits user habits (prefix/suffix checks and copy-paste workflows) rather than any cryptographic flaw, as explained in a news summary.

3. Aftermath and Laundering

To reduce the odds of a stablecoin freeze, attackers converted USDT to DAI and then into ETH before moving funds through Tornado Cash per a market update.

Similar address poisoning campaigns have targeted high-value wallets with automated bots and dusting activity, reinforcing that human factors are the weak link per an onchain recap.

Conclusion

USDT address poisoning stems from human-factor exploitation: attackers insert look-alike addresses into transaction history, users copy them, and wallet UI truncation hides differences. Rapid asset swapping and mixing compounds the loss. The most effective mitigation is process discipline around address verification and trusted recipient management.