A Simple Copy-Paste Mistake With Enormous Consequences

A crypto user "donated" $50 million worth of USDT to a group of hackers after copying a poisoned address from his transaction history, according to onchain security firm Web3 Antivirus.

The incident shows that in crypto, even experienced users can lose massive sums due to human error, not system vulnerabilities.

Investigators report that the victim had previously conducted a legitimate transaction with the intended recipient. However, attackers had subtly inserted a look-alike “poisoned” address into the victim’s transaction history using a small incoming transfer.

Minutes after sending a small test transaction to the correct wallet, the user unknowingly executed the full transfer to the fake address. This classic address poisoning attack illustrates how visual similarities in wallet addresses can trick even careful operators.

“This attack didn’t break any systems; it exploited predictable human behavior. Even seasoned crypto users can fall for these subtle traps if they rely on automatic copy-paste habits.”

Address poisoning scams rely on a deceptively simple tactic: attackers create malicious wallet addresses that closely resemble legitimate ones and insert them into a user’s wallet history via tiny transfers. When victims later copy an address, they may unknowingly select the attacker’s wallet.

Security researcher Cos, founder of SlowMist, noted that the fake and genuine addresses shared identical first three and last four characters, making them extremely difficult to distinguish visually. Onchain data shows the victim’s wallet had been active for over two years, primarily handling USDt transfers, and had recently received funds from Binance, indicating normal, active usage rather than a dormant or compromised account.

After receiving the stolen USDT, the attacker swapped it for Ether (ETH), divided the funds into multiple wallets, and laundered part through Tornado Cash, a privacy-focused mixer. This case demonstrates that social engineering attacks like address poisoning can be as devastating as large-scale hacks, yet require no technical exploitation — just a single, carefully orchestrated manipulation.

Experts emphasize that minimizing risk requires users to manually verify full wallet addresses, rely on trusted contact lists instead of copying addresses from history, and use human-readable addresses like ENS domains where possible. Failing to follow these precautions leaves even experienced investors vulnerable to high-value losses.

Address poisoning has rapidly emerged as one of crypto’s most insidious threats, exploiting the simplest of human habits. The broader ecosystem has faced a volatile 2025, with total crypto-related hacks and thefts reaching $3.4 billion, the highest annual total since 2022. Remarkably, just three major incidents accounted for nearly 70% of all losses, with one of the biggest cases being Bybit's $1.4 billion hack.

Even amidst high-tech vulnerabilities and large-scale cyberattacks, this incident proves that the most expensive mistakes remain human. Sometimes, it only takes a single copy and paste to trigger a catastrophic financial loss.

Incidents like this highlight a critical blind spot in crypto adoption: while blockchain systems are secure by design, human error remains a major attack vector, one that could be mitigated with better wallet interface design, verification tools, and careful operational discipline.