In January, a single victim lost $12.2 million after copying the wrong wallet address from their transaction history in an address poisoning attack, according to Scam Sniffer. The loss adds to a similar $50 million incident reported in December.
Address poisoning involves attackers sending small “dust” transactions from wallet addresses designed to closely resemble those in a target’s transaction history, increasing the chances that victims will copy and paste the wrong address.
Scam Sniffer also noted a sharp rise in signature phishing, with $6.27 million stolen from 4,741 victims in January—up 207% from December.
Just two wallets were responsible for 65% of all signature phishing losses.
Unlike address poisoning, signature phishing deceives users into signing malicious blockchain transactions, such as approvals that grant unlimited access to tokens.
Address poisoning shows no signs of slowing
“Address poisoning is one of the most consistent ways large amounts of crypto are lost,” Web3 security firm Web3 Antivirus said on Thursday.
The firm has tracked major address poisoning incidents over time, with losses ranging from $4 million to as much as $126 million. “Recent cases suggest this trend is not slowing down,” researchers added.
Address poisoning works by generating wallet addresses that match the first and last few characters of a legitimate address while differing in the middle, making them appear nearly identical at a glance, the researchers explained.
Dust attacks on Ethereum are surging
Analysts suggest that Ethereum’s Fusaka upgrade in December may have contributed to the rise in attacks by lowering transaction costs, making dust attacks cheaper to execute.
Stablecoin-related dust activity now accounts for an estimated 11% of all Ethereum transactions and 26% of active addresses on an average day, Coin Metrics reported earlier this month.
Coin Metrics analyzed more than 227 million balance updates for Ethereum-based stablecoin wallets between November 2025 and January 2026, finding that 38% were valued at less than one cent—“consistent with millions of wallets receiving tiny poisoning deposits,” the firm said.
Meanwhile, blockchain intelligence firm Whitestream reported on Sunday that the decentralized stablecoin DAI has developed a reputation as a preferred option for illicit actors, often used as a “parking place” for illegally sourced funds.
Whitestream attributed this in part to the protocol’s governance model, which does not cooperate with authorities to freeze DAI wallets, citing recent address poisoning cases.
