50 million dollars stolen—all because the address wasn’t checked carefully.

At around midnight yesterday, in Beijing time, a blockchain analyst named Specter discovered a case where nearly 50 million USDT were transferred to the hacker’s address due to insufficient verification of the transfer destination.

According to my investigation, this address (0xcB80784ef74C98A89b6Ab8D96ebE890859600819) initiated a test transaction on Binance around 1 PM on the 19th, transferring 50 USDT. Approximately 10 hours later, the same address transferred a total of 49,999,950 USDT from Binance, bringing the total to exactly 50 million USDT.

About 20 minutes later, the address that received the 50 million USDT transferred 50 USDT back to the original address for testing purposes.

Less than 15 minutes after the test transaction was completed, the hacker’s address 0xbaff…08f8b5 transferred just 0.005 USDT to the remaining 49,999,950 USDT address. The address used by the hacker closely resembled the address that received the initial 50 USDT, indicating a clear case of “address poisoning” attack.

After 10 minutes, when the address starting with 0xcB80 was about to transfer the remaining over 40 million USDT, it appeared that there was a mistake in copying the previous transaction. In fact, it was the same address used for the “poisoning” attack that transferred nearly 50 million USDT into the hacker’s hands.

眼见5000万美元到手，黑客在30分钟后就开始了洗钱动作。据慢雾监测，黑客先通过MetaMask将USDT交易为DAI，再使用全部的DAI买入约16690枚以太坊，留下10 ETH后剩余的以太坊全部转入Tornado Cash。

北京时间昨日16:00左右，受害者在链上对黑客喊话称已正式提起刑事诉讼，并已在执法部门、网络安全机构和多个区块链协议的协助下收集到大量关于该黑客活动的可靠情报。失主表示黑客可以留下100万美元，并将剩余98%的资金归还，如果黑客照做则不再追究;如果不配合就将通过法律途径追究黑客的刑事和民事责任，并将公开黑客身份。但截至目前，黑客还没有任何动静。

据Arkham平台整理的数据，该地址与币安、Kraken、Coinhako、Cobo地址均有大额转账记录。币安、Kraken和Cobo无需介绍，而Coinhako可能是一个相对陌生的名字。Coinhako是一家成立于2014年的新加坡本地加密货币交易所，于2022年获得新加坡金融管理局颁发的大型支付机构牌照，属于新加坡受监管的交易所。

鉴于该地址使用多地交易所以及Cobo托管服务，以及在案发24小时内就迅速联系各方完成了对黑客的追踪的能力，笔者猜测该地址大概率属于某机构而非个人。

「不小心」酿成大错

The only explanation for the success of this “address poisoning” attack is “carelessness”. Such attacks can be avoided by double-checking the address before making a transfer. But obviously, the person who carried out this attack skipped this crucial step.

Address poisoning attacks began in 2022, and the origin of these attacks lies in tools that allow users to create custom EVM addresses. For example, I can create an address starting with 0xeric to make it more recognizable.

This tool was later discovered by hackers, as its design allowed for brute-force attacks on private keys, resulting in several major financial theft incidents. However, the ability to create custom addresses also inspired some malicious individuals to come up with a clever strategy: they created addresses that resembled those commonly used by users, and then transferred funds from those addresses to other users. In this way, some users might accidentally use the hacker’s address as their own, thereby handing over their assets to the hackers.

Past data shows that addresses starting with 0xcB80 had already been targets of hacking attempts before this attack. The attacks started almost a year ago. This type of attack essentially involves betting that you will eventually fall for it due to laziness or negligence. It’s precisely this type of obvious attack that makes “careless” people continue to become victims.

Regarding this incident, Wang Chun, the co-founder of F2Pool, expressed sympathy for the victim in his post. He mentioned that last year, in order to test whether there was a leak of private keys associated with his address, he transferred 500 bitcoins there. However, 490 of those coins were stolen by hackers. Although Wang Chun’s experience isn’t related to address poisoning attacks, it likely aims to convey that everyone makes mistakes sometimes. We shouldn’t blame the victims for being careless, but instead focus on the hackers. $50 million isn’t a small amount, but it’s not the largest amount stolen in such attacks. In May 2024, an address was compromised and transferred over $70 million in WBTC to the hackers’ account. However, with the help of security companies like Match Systems and Cryptex, the victim managed to recover almost all of his funds through blockchain-based negotiations. However, it’s unclear whether the hackers successfully converted the stolen funds into ETH and transferred them to Tornado Cash.

Jameson Lopp, co-founder and chief security officer of Casa, warned in April that address poisoning attacks are spreading rapidly. Since 2023, there have been as many as 48,000 such incidents on the Bitcoin network alone.

These attacks involve simple methods like fake Zoom meeting links sent via Telegram. While these tactics may seem straightforward, it’s precisely this simplicity that can make people less vigilant. For us living in the Dark Forest, it’s always better to be cautious.