Ethereum address poisoning attack resulted in the theft of 12,000 USDC

Ethereum address poisoning attack causes victim to lose US$12,000 USDC

According to a report from online security monitoring platform ScamSniffer, a typical "address poisoning" attack caused a victim to send funds to a counterfeit wallet address, resulting in a loss of US$12,000 USDC. The incident is a textbook case of a social engineering attack that uses the way wallets display transaction history, putting users at risk of not being able to recover funds once the transfer is confirmed online.

History of the $12,000 USDC transfer incident

The attacker sent a zero or dust transaction from a carefully constructed address to the victim's wallet. The address mimics the victim's trusted counterparty, and its leading and trailing characters are exactly the same as the real address. When victims subsequently needed to send a USDC of $12,000 to the counterparty, they copied the contaminated address directly from the transaction history rather than obtaining it from a verified source.

USDC is a regulated dollar-pegged stablecoin issued by Circle and runs natively on the Ethereum network. Once the transfer is confirmed on the Ethereum blockchain, the funds disappear irreversibly. Since there is no refund mechanism for on-chain transactions, such attacks are more disruptive than traditional payment fraud.

The loss is reminiscent of a larger incident: a cryptographic user lost US$600,000 in USDC due to an address poisoning attack. This suggests that the tactic is suitable for both small retail transfers and institutional fund flows up to six figures.

How address poisoning can mislead Ethereum users

Similar address policies

Ethereum addresses are 42-bit hexadecimal strings. Most wallets and blockchain browsers only display the first six and last four characters. This means that two addresses may look exactly the same visually, but the hidden 32-bit characters in between are completely different. The attacker used brute force tools to generate "vanity addresses"(custom appearance addresses) that matched these visible fragments, and then implanted their fake addresses into the victim's history by sending trace transactions.

Why copying addresses from transaction history is risky

This attack exploits a common and understandable habit of users: reusing addresses seen in previous successful transfers. When victims scroll through the wallet's activity feed to find recipients, the attacker's counterfeit entry is often located on or immediately above the legitimate entry. A misreading or even no reading at all can lead to funds being sent to the wrong wallet. In this process, the attacker does not need to access the victim's private key or mnemonic words.

Before signing any USDC transfer on Ethereum, the sender should develop the full destination address and compare it verbatim with trusted sources such as saved contacts, official websites, or previously verified communication channels. Rapid visual inspection that only checks the first and last characters is the psychological blind spot exploited by such attacks.

Steps to prevent loss of address poisoning

The theft of a USDC of $12,000 can be avoided by applying a short checklist when executing each outbound transfer:

• Verify the full address from a trusted source: Copy the destination address from official websites, saved address book entries, or direct messages from recipients, and never copy it from transaction history.
• Use the wallet's address book or contacts feature: Saving verified addresses under tabs eliminates the need to copy from history, thereby completely removing the attack surface.
• Send small test transactions first: For any new or infrequent recipients, send the nominal amount first and confirm receipt before sending the full amount. The additional handling fee is far less than the cost of the entire loss.
• Review complete destination addresses before signing: Expand address fields in wallet or review raw transaction data. Confirm every character, not just visible prefixes and suffixes.

Address poisoning attacks require no other hacking skills other than generating custom appearance addresses, which makes them extremely low-cost when executed on a large scale. As USDC usage on Ethereum grows, this tactic will continue to target users who rely on transaction history as a shortcut. Treating each outbound transfer as a new verification step is the only reliable defense.