{"id":18417,"date":"2025-12-21T14:00:24","date_gmt":"2025-12-21T14:00:24","guid":{"rendered":"https:\/\/bitunikey.com\/news\/50m-usdt-stolen-after-victim-falls-for-address-poisoning-attack\/"},"modified":"2025-12-21T14:01:34","modified_gmt":"2025-12-21T14:01:34","slug":"50m-usdt-stolen-after-victim-falls-for-address-poisoning-attack","status":"publish","type":"post","link":"https:\/\/bitunikey.com\/news\/50m-usdt-stolen-after-victim-falls-for-address-poisoning-attack\/","title":{"rendered":"$50M USDT stolen after victim falls for address-poisoning attack"},"content":{"rendered":"<p><\/p>\n<div class=\"post-detail__content blocks\">\n<p class=\"is-style-lead\">A cryptocurrency trader lost nearly $50 million in USDT to an address poisoning scam on December 20, 2025.<\/p>\n<p>The victim transferred 49,999,950 USDT to a fraudulent address copied from transaction history.<\/p>\n<p>The entire theft happened in under one hour. SlowMist monitoring <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/x.com\/SlowMist_Team\/status\/2002201415440347227\" target=\"_blank\" rel=\"nofollow\">reported<\/a> that the stolen funds were rapidly converted to Ethereum, dispersed across multiple wallets, and partially laundered through Tornado Cash.<\/p>\n<p>The victim posted an on-chain message demanding return of 98% of the stolen funds within 48 hours.<\/p>\n<p>The victim also offered the attacker $1 million as a white-hat bounty while threatening legal and international law enforcement action.<\/p>\n<p>    <!-- .cn-block-related-link --><\/p>\n<h2 class=\"wp-block-heading\">Crypto attack exploited transaction history<\/h2>\n<p>The victim withdrew $50 million from Binance shortly before the attack occurred. Following standard security practices, the user first sent a small test transaction of 50 USDT to the intended recipient address.<\/p>\n<p>Minutes later, the attacker had already injected a fraudulent address into the victim\u2019s transaction history through a dust transaction of 0.005 USDT.<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\">\n<div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">How to lose $50M in under an hour. This is one of the largest on-chain scam losses we\u2019ve seen recently.<\/p>\n<p>A single victim lost $50M in <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/twitter.com\/search?q=%24USDT&amp;src=ctag&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"nofollow\">$USDT<\/a> to an address poisoning scam. The funds had arrived less than 1h earlier.<\/p>\n<p>The user first sent a small test tx to the correct address. Mins\u2026 <a rel=\"nofollow\" target=\"_blank\" rel=\"nofollow\" href=\"https:\/\/t.co\/Umsr8oTcXC\">pic.twitter.com\/Umsr8oTcXC<\/a><\/p>\n<p>\u2014 Web3 Antivirus (@web3_antivirus) <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/twitter.com\/web3_antivirus\/status\/2002043421368693140?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"nofollow\">December 19, 2025<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n<p>When the victim returned to send the full amount, they copied what appeared to be their destination address from recent transactions.<\/p>\n<p>The spoofed address matched the legitimate one in the first three and last four characters.<\/p>\n<p>The wallet had been active on-chain for approximately two years and was mainly used for USDT transfers.<\/p>\n<p>On-chain analysis suggests attackers were monitoring whale wallet movements, waiting for large transfers to execute the scam.<\/p>\n<h2 class=\"wp-block-heading\">Address poisoning reaches $3.4 billion in 2025 losses<\/h2>\n<p>The $50 million theft is a fraction of 2025\u2019s total address poisoning damage. The year has seen $3.4 billion in confirmed losses from address poisoning attacks across the cryptocurrency ecosystem.<\/p>\n<p>Over 158,000 personal wallets have been compromised, affecting 80,000 unique victims. September 2025 alone documented 32,290 suspicious poisoning events across multiple blockchain networks, impacting 6,516 unique victims.<\/p>\n<p>Researchers have tracked over 270 million poisoning attempts across Ethereum and Binance Smart Chain.<\/p>\n<p>Confirmed losses specifically attributed to address poisoning techniques exceed $83.8 million beyond the headline incidents.<\/p>\n<p>Scammers monitor blockchain activity for high-value transfers, then immediately inject poisoned addresses that appear in victims\u2019 transaction histories at opportune moments.<\/p>\n<p>    <!-- .cn-block-related-link --><\/p><\/div>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A cryptocurrency trader lost nearly $50 million in USDT to an address poisoning scam on December 20, 2025. The victim transferred 49,999,950 USDT to a fraudulent address copied from transaction&hellip;<\/p>\n","protected":false},"author":1,"featured_media":13174,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-18417","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cryptocurrency"],"_links":{"self":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/18417","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/comments?post=18417"}],"version-history":[{"count":1,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/18417\/revisions"}],"predecessor-version":[{"id":18418,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/18417\/revisions\/18418"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/media\/13174"}],"wp:attachment":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/media?parent=18417"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/categories?post=18417"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/tags?post=18417"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}