ScamSniffer: $50K USDT lost to Ethereum address-poisoning lookalike 0xd967a1c9...92bd16f9
ScamSniffer, a company that tracks wallet-draining and address-poisoning attacks, reported on 28 October 2026 that a user lost about $50,000 in USDT on Ethereum after sending funds to a lookalike address. The address …
- First reported
- Reports
- 1
Source: x.com · published
What happened
ScamSniffer, a company that tracks wallet-draining and address-poisoning attacks, reported on 28 October 2026 that a user lost about $50,000 in USDT on Ethereum after sending funds to a lookalike address. The address the funds went to begins 0xd967a1c9 and ends 92bd16f9. ScamSniffer says it matched the first and last characters of the address the victim had meant to use. We do not publish the victim's own address.
How the scam works
Address poisoning exploits a habit: most wallets and block explorers show only the first and last few characters of an address, and many people copy an address from their transaction history. The attacker generates a new address whose beginning and end match one the victim has used. They then send a tiny or zero-value transfer from that lookalike address, so it appears in the victim's history next to the genuine one. Later, when the victim goes to send a payment, they copy the most recent address from history, check the first and last characters, and send the funds to the attacker.
At this scale the lookalike was probably created with software that searches for matching prefixes and suffixes, which is cheap for the attacker and gives a large reward from a single mistake. Blockchain transfers are final, so once the money has gone it cannot be recalled by a bank or a service. Some stolen funds are quickly moved through other addresses or exchanges.
There are practical ways to reduce the risk. Check the entire address, not just the ends, before sending a large amount. Keep a saved address book of verified contacts and use it. Send a small test amount first when paying a new address. Treat unexpected zero-value or dust transfers as a warning that your address may have been targeted.
Source
ScamSniffer post on X, 28 October 2026, describing the $50K USDT address-poisoning loss.
Red flags
- Unexpected tiny or zero-value transfers from an address that looks almost identical to one you use.
- Copying a recipient address from transaction history instead of a verified source.
- An address that matches only the first and last few characters of the intended one.
- A large payment sent without a test transaction.
- Wallet interfaces that shorten addresses, hiding the differing middle section.
If you were targeted
- 1Compare the full address character by character before sending significant funds.
- 2Save verified recipients in an address book and pick from it, not from history.
- 3Send a small test amount first for any new or large payment.
- 4Ignore and do not interact with dust transfers; hide them in your wallet if possible.
- 5If it happens, report it to the exchange where funds land and to the police; recovery is rare.