What happened
Web3 anti-scam service Scam Sniffer (@realScamSniffer) reported on X on 12 November 2026 that a user lost about $11.7K in USDC on Ethereum to an address-poisoning attack. The funds went to 0x7f8226aa9f47ec9e0db0b552537e3236fd773319, a lookalike of the address the user meant to pay, which the shared transaction screenshot labels as a Binance deposit address. Both addresses start with 0x7f82 and end in 3319, and the screenshot shows earlier zero-value and dust transfers from lookalike addresses that seeded the victim's history weeks before. Binance is not involved; its deposit address was the one being imitated. Always check the full address, not just the first and last characters, and copy it from the exchange itself rather than from wallet history.
How the scam works
Crypto phishing and draining sites ask you to connect a wallet, sign a transaction, 'claim' a token, or paste a recovery phrase. Once you approve the request, the operator can empty the wallet. Address-poisoning works differently: the operator sends dust or zero-value transfers from a look-alike address so that, later, a hurried copy-paste from the transaction history goes to them instead of to the address you meant. Always check every character of an address, and never connect a wallet or enter a seed phrase on a site you reached from a message, a pop-up or a look-alike URL. Official wallet and exchange brands named in a lure are not involved.
If a message, a page or a caller creates urgency about money, a login or a legal threat, pause and check the claim through a contact method you already trust. Keep screenshots, reference numbers and the exact addresses or phone numbers you were given, and tell your bank early if money has already left the account. Official brands and authorised firms named in a lure are not involved unless a primary source says otherwise.
Source
Source: https://x.com/realScamSniffer/status/2120904458255352112 (@realScamSniffer, Nov 12, 2026, 10:40 AM ET)
