A note before you read: this one is for people who hold stablecoins, not the developers who usually read this account. If it is useful, send it to someone who makes large transfers.
On December 20, 2025, someone followed the standard advice.
They were about to send a large stablecoin transfer, so they sent a small test first — $50 to the destination address. Twenty-six minutes later they sent the rest — 49,999,950 USDT, about $50 million in total — to a lookalike address the bot had planted minutes earlier. (Blockaid incident report, 2025-12-20.)
That is address poisoning — an attack aimed precisely at people who follow the standard advice. The victim here was moving USDT; the mechanism does not care which token you are moving. It hits USDC the same way.
How the trick works
The attack starts with a tiny unknown transfer. A tiny amount of USDC or USDT lands in your wallet from an address you do not recognize, and you probably glance at it and move on. The address is not random: its first and last characters match an address you deal with regularly — an exchange you withdraw from, a service you pay regularly, a trader you buy coins from directly. The middle, where the difference actually lives, is the part nobody reads: wallets and block explorers — the websites where you look up transactions — usually show only the first and last few characters of an address.
Days later you make a real transfer. You open your transaction history, find that address, copy it, paste it, confirm. You copied the attacker's. The network confirms the transfer, and from the wallet's perspective everything was normal: no typo, no malware, no phishing site — just a line that looked familiar.
A fund that lost $2M in USDC this way is a good case study (EIDEX write-up, 2026-08-25): a 0.0002 USDC decoy had been sitting in the fund's own transaction history for about twenty hours, and an operator copied that line — which belonged to somebody else — for the large transfer. The firm had traded with the real counterparty before. Familiarity was the vulnerability.
The blunt rule from the case write-ups: your transaction history is for reading, not for copying.
The scale
Blockaid has flagged over 65.4 million address-poisoning transactions on-chain since January 2025 — an average of roughly 160,000 per day across that period. About 316,000 of them were confirmed losses, meaning roughly one in every 200 attempts succeeds.
It is accelerating. Ethereum's Fusaka upgrade on December 3, 2025 cut transaction fees by about six times, and poisoning attempts jumped from 628,000 in November 2025 to 3.4 million in January 2026 — a 5.5× increase in two months.
Earlier research gives the baseline: roughly 17 million poisoning attempts against at least 1.3 million users and $79.3 million in losses between July 2022 and June 2024 (as cited by EIDEX). Coin Metrics found that stablecoin dust — tiny, near-worthless transfers sprayed at thousands of wallets — now makes up 10–15% of all Ethereum transactions, up from 3–5% before the upgrade. Cheap dust is a big net.
In a case Blockaid documented on January 30, 2026, a holder lost 4,556 ETH (about $12.4M) to an address that had been dusting their wallet for more than two months.
Why the test transfer is not enough anymore
The standard advice for a large transfer is to send a small test first and wait for the recipient to confirm receipt. The problem — visible in the $50M case above — is that the attackers found out too. Sophisticated bots watch the network in real time and catch small test transfers as they happen. When they see one, they generate a lookalike address, plant it with a dust transfer, and wait for the follow-up. The defense you were taught got weaponized against the security-conscious.
So the test transfer still helps — but only if the recipient actually confirms receipt, and the address you send the big transfer to is re-verified against a source that is not your own transaction history.
The habit worth building
Case write-ups and Trezor's guidance converge on a short list:
- Never copy addresses from your own transaction history. Treat it as read-only.
- Keep real addresses in an address book — saved once, clearly labeled — and initiate large transfers only from there. Or get the address from the counterparty through a channel you can verify independently — a known email thread, an app you already use, a call to a number you already have.
- Send a small test transfer before the big one, and wait for the recipient to confirm.
- Run the address through a checker before you send: checksum, network, token.
Point 4 is the least familiar step. "Check the address carefully" is not a process — it is a hope. A checker makes it a step: you paste the exact string you are about to send to, and it tells you whether the checksum holds (every address carries a built-in pattern of capital and lower-case letters — change one character and it fails), whether it is on the network you think, and whether the token is what you expect. It cannot tell you the address belongs to the person you mean to pay — only your address book or the counterparty can do that. A poisoned address is a perfectly valid address: it passes every string check, which is exactly why points 1 to 3 do the heavy lifting. What a checker catches is everything else — a mistyped character, a wrong network, a wrong token, a contract where you expected a wallet — the mistakes a glance never will.
What we use
We are Pennyforge, a one-person studio that builds small verification tools. Our free check page (sendcheck.surge.sh) does this and a little more: paste an address, and your browser checks the checksum, the network and token, whether the address is a contract (a program) rather than a wallet, and its balance data — then gives you a verdict with a line on what to do next. Three free checks a day, no login. There is also a share-link format that carries the address in the URL, so you can send a "check this" link and the recipient's browser runs a fresh check at no cost — the link is a pointer to re-verification, not a saved result.
It is not a replacement for an address book. It is the step between "I think this is right" and "I sent it."
The tiny unknown transfer sitting in your history is a signal, not noise. It is someone paying almost nothing to live in your wallet for a long time. Check before you send the big one — from your address book, not your history.
Sources
- Blockaid — Address poisoning: the growing threat draining millions from crypto users (2025–26 tracking data): https://blockaid.io/blog/address-poisoning-the-growing-threat-draining-millions-from-crypto-users
- Blockaid incident — $50M USDT, December 20, 2025: https://docs.blockaid.io/docs/security-incidents/address-poisoning-50m-usdt-dec-20-2025
- Blockaid incident — 4,556 ETH (≈$12.4M), January 30, 2026: https://docs.blockaid.io/docs/security-incidents/12m-address-poisoning-jan-30-2026
- EIDEX — How address poisoning cost one firm $2 million (2026-08-25): https://eidex.io/blog/address-poisoning
- Trezor — What are address poisoning attacks and how to avoid them: https://trezor.io/support/troubleshooting/coins-tokens/what-are-address-poisoning-attacks-and-how-to-avoid-them
Top comments (0)