A $68M address-poisoning attack: anatomy of a single transaction

Sometimes stealing funds requires no exchange breach and no spoofed front end. All it takes is the human habit of copying an address without looking. In May 2024 a single transaction carried off roughly $68 million — and all it took was a look-alike address that matched the real one at the start and at the end. Let's take this attack apart character by character.

What "address poisoning" is

A crypto address is a long string of dozens of characters. Nobody memorises it, and almost nobody checks it in full. In practice people do one of two things: they either copy the address from their own transaction history, or they glance quickly at the "beginning and end" and skip the middle. The address poisoning attack is built precisely on this habit.

The idea is simple and insidious. The attacker generates a look-alike address in advance, one whose first and last characters match the address the victim actually uses. The attacker then "plants" this twin in the victim's transaction history — for example, through a tiny or zero-value transfer, so that the decoy address shows up in the list of operations. The bet is that next time the victim will copy the recipient's address not from a trustworthy source but from their own "poisoned" history — and send the money to the twin.

Anatomy of the strike: one transaction, $68M

In May 2024 this scheme paid off on an especially large scale. In transaction 0x87c6e5…bf73 the victim sent roughly $68 million — but not to the intended address, rather to a look-alike prepared by the attacker. The twin was chosen so that it began with 0xd9A1 and ended with 853a91: a quick "first characters right, last characters right" check created the false impression that everything was in order.

The entire middle of the address, meanwhile, belonged to someone else. But the middle is exactly what people don't check. One motion — copy the "familiar" address from history, paste, confirm — and tens of millions went to the criminal. No hacked wallet, no stolen keys, no malicious code: pure psychology and inattention did the work.

Why it worked: a step-by-step breakdown

Let's break the attack into its parts to see exactly where an ordinary user's defences give way.

1. Generating the twin. By brute force, the attacker finds an address whose leading and trailing characters match those of the victim's address. This is computationally expensive, but with tens of millions at stake it pays off.
2. Poisoning the history. The twin is made to appear in the victim's transactions via a micro-transfer or technical transfer, so that it lands in their list of operations and looks "familiar".
3. Waiting. The attacker waits for the victim to next want to send funds "to the same place".
4. The copy-paste error. The victim takes the address not from a trusted source but from the poisoned history — and, going by the matching ends, mistakes the twin for the real address.
5. Irreversibility. The transaction is confirmed on the blockchain. It can't be undone: the transfer went out legitimately signed, just to the wrong place.

The key psychological trick is exploiting the "beginning-and-end" heuristic. Our brain looks for shortcuts: if the first four characters match and the last six match, it fills in the conclusion "this is the right address". A poisoning attack is, in essence, an attack not on code but on this cognitive shortcut.

Here that maxim rings especially bitter. The victim had full ownership of their keys and voluntarily signed the transaction. The theft happened not because someone gained access to the wallet, but because the owner personally directed the funds to the twin. No hardware wallet and no strong password protects against that kind of mistake — only verifying the address does.

How to protect yourself: practical rules

What this means for AML checks

Address poisoning matters to the reviewer too, not just to the owner of the funds. First, "dusting" micro-transfers from look-alike addresses are a recognisable pattern worth noticing when reviewing a wallet's history: their presence tells you the address has been targeted (and therefore may have erroneous outgoing transfers too). Second, the look-alike address that received the stolen $68 million itself becomes a "dirty" node: the funds on it are the proceeds of theft, and any exposure to such an address carries maximum risk.

Finally, this case is a reminder that not every large loss of funds is tied to an infrastructure breach. Sometimes the "source" of dirty money turns out to be a decoy address, and the victim is a perfectly honest user who made one fatal copy-paste mistake. When reviewing a disputed transaction, it's useful to keep this scenario in mind as well.

Why poisoning is more dangerous than a "regular" hack

It's tempting to file address poisoning under "petty" tricks against the backdrop of multi-billion-dollar exchange and bridge hacks. That's a mistake. Poisoning has three properties that make it insidious in its own way. First, it requires no code vulnerability at all — which means smart-contract audits, wallet updates, and hardware devices provide no protection against it. The vulnerability is in the user's head, and it can't be "patched" with a release.

Second, the attack scales cheaply. Generating a twin and dropping "dust" costs next to nothing, and it can be done for thousands of potential victims at once, patiently waiting to see which of them slips up. A single successful haul of tens of millions pays for millions of failed attempts. Third, the attack disguises itself as normal: in the poisoned history the twin looks like an ordinary past operation, not like something suspicious. The victim doesn't feel under attack — they are confident they are acting as usual and safely.

That's exactly why the discipline of verifying the address is not paranoia but basic hygiene, comparable in importance to key storage. Technical safeguards have shifted the point of attack: since breaking into a wallet directly is hard, the attacker goes after the ritual of the transfer instead. And the only barrier on this path is the human habit of checking the address in full and taking it only from a trusted source.

Facts are presented from open sources. This material is for educational purposes.