A cryptocurrency trader suffered a devastating loss of 4,556 ETH (approximately $12.4 million) after falling victim to an elaborate address poisoning scam. The attack exploited a common user behavior: copying wallet addresses from transaction history.
The scammer generated a fake wallet address that shared the same first and last four characters as the legitimate deposit address for Galaxy Digital, a prominent crypto investment firm. To make the fake address appear in the victim's transaction history, the attacker sent multiple tiny "dust" transactions to the victim's wallet (0xd674).
When the trader, who frequently transferred funds to Galaxy Digital via the legitimate address (0x6D90CC...dD2E48), went to execute a transaction, he copied what he believed was the correct address from his history. Without verifying the full address string, he initiated the transfer, sending the entire 4,556 ETH balance to the attacker's "poisoned" address. The attacker swiftly swept the funds, leaving only 6.8 ETH remaining in the victim's wallet.
Blockchain analytics platform Lookonchain first reported the incident on January 31, 2026, highlighting the copy-paste error that enabled the multi-million dollar theft. This event underscores a growing trend of address poisoning attacks, where hackers rely on user complacency and the visual similarity of addresses.
The incident has sparked warnings from the community about the critical importance of security practices. Experts and users advise against copying addresses from transaction history, recommending instead the use of verified address books or Ethereum Name Service (ENS) domains. Some, like user Mark Huber, suggest sending large sums in smaller batches to mitigate potential total loss.
This is not an isolated case. The report references a similar, even larger incident in December 2025, where a user lost $50 million after copying a spoofed address. In that instance, the attacker used a small, successful test transaction of $50 to establish legitimacy before the victim sent the remaining $49,999,950.
