USDT address poisoning scam: how it works, the US$68 million and US$129 million cases, and how to defend yourself
The scammer does not break into the wallet. He plants in the victim's history an address that looks like the recipient's and waits for the wrong copy. In 2024, the trick took US$68 million in wrapped bitcoin and about US$129 million in USDT on TRON.
Historical reference: December 17, 2024. Published on this site on November 2, 2026. Dates in the text identify the period covered.
In this article
Key points
- In address poisoning, the scammer creates a wallet with the same start and the same end as the victim's destination wallet and sends a minimal transaction so that it appears in the history.
- The victim copies the address from the history, without checking the middle, and sends the money to the scammer. A confirmed transfer cannot be undone.
- In May 2024, 1,155 WBTC (about US$68 million) were sent to the scammer. In November, about US$129 million in USDT on TRON. In both cases, almost everything came back, which is rare.
- The protection is simple: never copy from the history, check the whole address, use an address book and send a test transfer.
A payment of millions of dollars in USDT leaves a company's wallet for an address that looks like the supplier's. The first and last characters match. The middle does not. The money reaches a scammer. This is how address poisoning works, a fraud that does not depend on breaking into any system. It depends on a rushed check. Two cases from 2024 show the size of the problem.
How the scam works
Wallet addresses are long strings that are hard to memorize. That is why almost everyone checks only the beginning and the end. The scammer exploits this habit in four steps:
- Observation. He monitors the blockchain, which is public, and identifies large transfers between two addresses.
- Forgery. With programs that generate millions of wallets, he produces an address with the same start and the same end as the real recipient.
- Contamination. He sends the victim a transaction with no value, or a minimal value, from the lookalike address. It now appears in the wallet's history, next to the true address.
- Error. On the next transfer, the victim opens the history, copies the address that looks right and pastes it. The payment goes to the scammer.
None of this requires access to the victim's private key.
The US$68 million wrapped bitcoin case
On May 3, 2024, a user sent 1,155 WBTC, the version of bitcoin on Ethereum, to a fake address. The loss, of about US$68 million, was first flagged by CertiK and confirmed by Cyvers and the investigator ZachXBT, according to CoinDesk. The scammer imitated the first six and the last six characters of the usual recipient and used a transfer of 0.05 ETH as bait.
The outcome was unusual. The scammer converted the amount to ETH and, after an on-chain negotiation in which the victim agreed to leave 10% as a reward, began returning the funds on May 10. In more than 225 transactions, he sent back about 22,960 ETH (US$65.7 million at the time), more than 96% of the amount, according to Cointelegraph. It was an exception, not the rule.
The US$129 million USDT case on TRON
On November 20, the security firm Scam Sniffer reported the attack on an investor who was sending about US$129 million in USDT on the TRON network. The correct destination address began with “TMS” and ended in “bu8”. The fake one began with “THc” and ended in “bu8”. After a 100 USDT test, the victim sent the rest to the wrong address. According to Scam Sniffer, the case was “a classic example” of poisoning.
The scammer returned 116.7 million USDT within an hour and the remaining 12.96 million four hours later, and the victim resent the amount to the right address, according to CryptoSlate. The reason for the return is not clear. The central point is a different one: the victim ran a 100 USDT test beforehand and still got the address of the main payment wrong. The test only protects when the address comes from a trusted source.
- Sent to the scammer on May 3, 2024, about US$68 million
- 1,155 WBTC
- Share returned in the May case, in ETH
- 96%
- USDT sent to the fake address on TRON on Nov 20, 2024
- ~US$129 mn
- Time until the USDT was fully returned, according to CryptoSlate
- ~4 h
How to protect yourself
The defense is procedural. It applies to any network, and even more to those who make recurring USDT payments, because routine builds the habit of trusting the history.
| Practice | Why it works |
|---|---|
| Never copy the address from the transaction history | The history is exactly what the scammer contaminates |
| Check the whole address, character by character | The attack only fools those who look at the start and end |
| Use the wallet's or platform's address book | An address saved after verification does not depend on memory or on the history |
| Confirm the address with the recipient through another channel | Reduces the risk of a tampered email or conversation |
| Send a test transfer copying the address from the official channel | If the test reaches the right destination, the main payment uses the same address |
| Check the address on the hardware wallet's screen | The device's screen shows what will actually be signed |
Both cases ended in a return, but no rule obliges the scammer to give the money back. In practice, money sent to the wrong address is usually lost. Treat tiny, unexpected transactions from unknown addresses as a warning sign, and never interact with them.
For companies: making the check a routine
Those who pay suppliers often face more risk, because routine encourages the shortcut of repeating the last payment. The central control is to separate who registers the address from who approves the transfer, and never to build the payment from the history. A few simple controls:
- Register each supplier's address only once, with confirmation through a second channel (for example, a call to an already known phone number), and reuse only the registration.
- Require dual approval for amounts above a limit set by the company, with both approvers checking the full address.
- Block transfers to addresses outside the registered list, when the platform allows it.
- Record the hash of each transaction and confirm the destination on the network's public explorer (on TRON, Tronscan) right after sending.
To understand the basis of the check, it is worth reviewing the address format on TRON and what USDT actually is. Other frauds are in the Security category.
Frequently asked questions
What is address poisoning?
It is a scam in which the criminal generates a wallet with the same start and the same end as the address the victim uses and sends the victim a minimal transaction. The fake address enters the history, and the victim, by copying it, sends the money to the scammer.
Does the scam need my private key or password?
No. It relies only on public blockchain data and on a checking mistake. That is why the protection is procedural and does not depend on antivirus software or a strong password.
Can I recover USDT sent to the wrong address?
In general, no. Confirmed transactions are irreversible. Tether can freeze USDT at addresses linked to crime, at the request of authorities, but there is no guarantee of return. In both 2024 cases, the scammers returned almost everything: in the first, after a negotiation; in the second, with no public explanation.
How can I tell if I received a poisoning transaction?
Be wary of transfers of zero or trivial value from unknown addresses, especially right after a payment of yours. Always compare the full address with the one provided by the recipient through a trusted channel.
Found it useful? Share it with anyone who pays suppliers abroad.
Sources
- Exploiter steals $68M worth of crypto through address poisoning · CoinDesk, May 3, 2024
- WBTC address poisoner returns nearly all funds after negotiations · Cointelegraph, May 10, 2024
- Crypto phishing scam nets $129 million in USDT then funds mysteriously return · CryptoSlate, Nov 20, 2024
For information only, not investment advice. Third-party brands mentioned belong to their owners; the mention is journalistic and does not indicate a partnership or relationship with Swapo Finance.
International payments with the speed of Pix and Central Bank rules.
Convert reais into USDT and send it to your supplier on the TRON network. One fee shown upfront, asset segregation policy, human support. Virtual assets have no FGC coverage; authorization application filed with the BCB.
