According to Scam Sniffer, a cryptocurrency user lost approximately $50,000 in USDT due to a poisoning attack on their Ethereum address.

Scam Sniffer indicates that this forged address has the same first four and last six characters as the target recipient's address. The security platform also published these two addresses, along with a screenshot of the transaction history, showing that the payment was transferred to the wrong address.

Address poisoning utilizes payment records that seem familiar

In its security guidelines, MetaMask describes "address poisoning" as a fraudulent tactic, which involves inserting an address that looks similar into a user's transaction history. Attackers monitor token transfers, usually involving stablecoins, and then generate an address that resembles one that the target has previously used.

According to this wallet provider, a token transfer with an extremely low value or even zero value could result in the counterfeit address being recorded in the target user's activity history. Subsequently, the attacker waited for the user to copy the incorrect recipient address when preparing for the next payment.

MetaMask explains that the display of abbreviated addresses can mask differences: the beginning and ending characters may seem familiar, but the middle part of the address is different.

The previous USDT theft involved implanted addresses and test transfers.

In a case on August 11th, crypto.news previously reported that a user lost approximately 100,000 USDT after selecting a counterfeit address that had been implanted 66 days ago in the wallet history. The relevant information comes from Cyvers Alerts.

Cyvers indicates that the victim relied on historical records and did not verify the complete address. After receiving the payment, the attacker exchanged USDT for ETH; at the time the security company issued an alert, the recipient wallet contained approximately 52.8 ETH.

The company described this incident as a social engineering attack involving the forgery of address records. Its initial statement did not confirm the identities of the victims, nor did it mention any measures to recover or return the funds, or the involvement of exchanges. Cyvers attributed the losses to the failure to verify complete addresses and advised against regarding transaction histories as a reliable list of valid addresses. The security firm stated that such exchanges seemed to be intended to reduce the risk of stablecoins being frozen.

Another case disclosed on December 21, 2025, showed that a trader first sent a test payment of 50 USDT to the target address, and then transferred 49,999,950 USDT to a fraudulent address.

According to the report, the attacker first inserted a dust transaction of 0.005 USDT into the victim's transaction history before carrying out the large-value transfer. This counterfeit address shared the same first three and last four characters with the real address, which the victim copied when preparing for the remaining transfer.

Reports cited SlowMist monitoring as stating that the funds were subsequently exchanged for ETH, distributed across multiple wallets, and part of it was transferred through Tornado Cash. The victims then offered a reward of $1 million and demanded the return of 98% of the funds within 48 hours through on-chain messages.

MetaMask states that a risk warning will be given before the transfer.

MetaMask indicates that its wallet will compare the intended destination address with the addresses in the sender's transaction history. If the new address is very similar to an address that has been used before, the software will display a warning to prevent the transaction from proceeding before it is submitted.

The document example states that if the first four digits of an address are the same, but the characters in between are different, a prompt will be triggered. If a user transfers funds to an address with which they have never interacted before, another type of warning will appear. However, the provider indicates that a unfamiliar address is not necessarily a malicious one.

MetaMask It is recommended to save the verified payment addresses in Contacts.

The block browser filtering mechanism is also affected by poisoning records.

On March 14, Zhao Changpeng, co-founder of Binance, criticized the junk information in transaction history. At that time, a user identified as Nima claimed that after making two stablecoin transfers on Ethereum, they received 89 spam emails within less than 30 minutes.

Zhao Changpeng stated that Trust Wallet has already filtered out these transactions and called on blockchain browsers to remove the malicious entries. The report also mentioned that another user Xeift added that Etherscan defaults to hiding zero-value transfers, while BscScan and Basescan require users to enable the “hide 0 amount tx” control option.

It is reported that Nima warned, "Many people will suffer as a result." These messages document repeated attempts at poisoning and are not described as 89 completed thefts. Etherscan issued a warning about this tactic, explaining that attackers attempt to trick users into copying seemingly similar addresses from their transaction history.

Zhao Changpeng admitted that the filtering mechanism might affect small payments between AI proxies, and suggested using AI to distinguish between normal transfers and spam messages.

In June 2024, Ledger warned that there was a type of fraudulent transaction aimed at making users mistakenly believe they had transferred funds to the attacker's address. The counterfeit addresses described in the warning shared the first four or five characters and the last four or five characters of the legitimate recipient's address.

Ledger indicates that a record that appears without request will not transfer funds from the recipient's account on its own. To initiate an outgoing payment, users still need to actively proceed and sign the transaction on their device. The company recommends that users hide unwanted tokens and NFT in the wallet interface, and avoid interacting with suspicious assets or their associated addresses.

The warning from Ledger also mentions that small amounts of cryptocurrency deposits and NFT disguised as credentials may both induce users to transfer their assets back to fraudulent accounts.

According to the Ledger guidelines for June 2024, users can right-click on the relevant assets and select to hide tokens or the NFT series, thereby removing unwanted assets from the view.