The incident highlights ongoing risks of address poisoning scams, which have caused multi-million-dollar losses in recent months.
A crypto user has lost more than $500,000 worth of USDT after falling victim to an address poisoning attack on the Ethereum blockchain, highlighting once again how simple mistakes can lead to massive losses in onchain transactions.
The incident was detected at 14:01 UTC, with blockchain security firm CyversAlerts publicly flagging it shortly after at 14:34 UTC. It is among the first reported address poisoning cases of 2026, underlining that this type of scam remains a persistent threat despite growing awareness in the crypto space.
According to CyversAlerts, the victim initially sent a test transaction of 5,000 USDT to what they believed was the correct wallet address. The address appeared familiar because it closely resembled the intended recipient, ending in D3E6F.
The address was however under control of a scammer and it was slightly different in the middle character details which are normally hidden or abbreviated in wallet interfaces.
Only two minutes later, the victim made a bulk transfer of 509,000 USDT to the same poisoned address after the test transfer had succeeded. Overall, the victim had lost about $514,000.
The attack timeline indicates that the scammer had prepared in detail long before the attack. The attacker initially sent several small payments using similar looking addresses to the wallet of the victim, intentionally contaminating the history of transactions.
The victim had copied the address of the previous transactions believing it to be legit, thus choosing the wallet of the scammer as opposed to the real wallet. The money was effectively lost once it was committed on-chain.
Address poisoning attacks take advantage of such habits as copying wallet addresses on the transaction history and not checking them character by character.
This event is preceded by a significantly bigger address poisoning incident in December 2025, when an experienced trader lost almost half a million dollars in USDT in one transaction.
In such a scenario, the attacker would have used an address that resembled the first three and last four characters of the legitimate wallet which would seem genuine at first sight.
The victim had already made a valid test transfer but then copied a tainted address in the history of transfers when making the full transfer. The attacker soon transferred the money to ETH and laundered it through several wallets, and eventually laundered some of the assets through Tornado Cash, making the trail go cold.
The importance of addressing poisoning scams is that they do not depend on hacking smart contracts or using protocols. Rather, they are user behavioral directed.
The risk exposure of both retail users and professional traders is rising as crypto usage continues to rise and the number of transactions of the stablecoins such as USDT is high daily.
The latest cases, such as a crypto giveaway scam that took advantage of the official communication channels of Betterment, demonstrate how scammers are changing.
They are becoming more and more dependent on the credibility of trusted platforms, familiar interfaces, and technical tricks to earn credibility. To the wider crypto community, such incidents drive a bitter truth: blockchain transactions are permanent.
Even seasoned users may commit expensive mistakes and once money is transferred onchain, it is hard to retrieve. With the trading activity still at its peak, these scams are still a major threat to the market participants, and this is why more protection to the user and vigilance is of utmost importance.
