$50 million disaster: Beware of address poisoning attacks, think carefully before trading

【Crypto World】Recently, another shocking security incident has come to light. A crypto trader was sniped by an automated script, and $50 million worth of USDT was instantly wiped out from their account.

Here’s what happened: the victim initially performed a routine operation—a test transaction of $50 to confirm the address. But the malicious actors had been waiting in the shadows. Their script immediately generated a seemingly “normal” fake address after the transaction was completed, which was easy to copy and paste from the history.

What followed was a tragedy. The victim copied this fake address from the transaction history and sent 49,999,950 USDT directly. You read that right, in just a moment. The attacker immediately started to move the funds: first swapping USDT for DAI, then converting into about 16,680 ETH, and finally transferring everything into Tornado Cash to completely disappear.

Now, the victim is offering a $1 million bounty to recover 98% of the losses and has filed a criminal case. But honestly, once your funds go into a mixer like Tornado Cash, it’s basically searching for a needle in a haystack.

This incident serves as a stark warning to everyone. No matter how large the amount, always double-check the recipient address before transferring. It’s best to use the official wallet’s bookmark feature instead of lazily copying from the history. Being cautious is the real hard rule.