Fifty Million USDT Stolen In Address Poisoning Scam Prompts Legal Threats

TLDR

Table of Contents

Crypto user lost $50 million in USDT due to an address poisoning scam.
Scammer sent dust transactions to trick the victim into copying the address.
Stolen funds were swapped for ETH and moved through multiple wallets.
Victim offers $1 million white-hat bounty and threatens legal action.

A crypto user lost $50 million in USDT after falling victim to an “address poisoning” scam, a method exploiting user habits rather than technical vulnerabilities. The scam involved a fraudulent wallet address closely resembling the intended recipient’s address. The victim is now offering a $1 million bounty for the return of 98% of the stolen funds and has threatened legal action if the assets are not returned within 48 hours.

Address Poisoning Scam Explained

The theft occurred when the victim sent a small $50 test transaction to verify the wallet address before transferring the full amount. Within minutes, a scammer created a wallet address nearly identical to the intended destination, matching the first and last characters. Most crypto wallets display only partial addresses, which helped the scam succeed.

Someone just lost $50,000,000 to a single copy-paste mistake.
Here’s how it happened:
• The victim sent 50 USDT as a test transaction.
• A scammer instantly deployed a spoofed wallet matching the same first and last characters.
• Because most wallets truncate addresses with… pic.twitter.com/J3jVWJt2J4
— Parker 🐐 (@DotComParker) December 21, 2025

The scammer then sent a small “dust” amount to the victim’s transaction history. The victim copied the address from this history, believing it to be the correct destination, and transferred $49,999,950 USDT to the fraudulent wallet. Web3 security firm Web3 Antivirus identified the theft, highlighting how attackers exploit human error rather than software flaws.

Movement of Stolen Funds

Blockchain data indicates that the stolen funds were converted into ether and moved across multiple wallets. Several addresses interacted with Tornado Cash, a crypto mixer sanctioned to obfuscate transaction trails. This method complicates tracing and recovery, as the assets are layered across several decentralized addresses.

Address poisoning is a technique used by bots sending small amounts of tokens to users with large holdings. These bots aim to poison transaction histories and catch users in copy-paste errors. In this case, the method worked, showing the effectiveness of such social engineering strategies in cryptocurrency thefts.

Victim Response and Bounty Offer

In response to the theft, the victim published an onchain message demanding the return of 98% of the stolen funds within 48 hours. The message also offered a $1 million white-hat bounty for returning the assets.

BREAKING NEWS : Victim offers $1 million bounty for $50 million crypto theft. https://t.co/DRxg4LHJfo #cryptotheft #bounty #legalthreat pic.twitter.com/gDxe3ALEAC
— Rayan Bibiloni (@rayan_bibiloni) December 20, 2025

The message warned of legal escalation and criminal charges if the funds were not returned. It stated, “This is your final opportunity to resolve this matter peacefully. If you fail to comply, we will escalate the matter through legal international law enforcement channels.” The victim’s approach combines financial incentives with formal legal threats to recover the assets.

Security Awareness in Crypto Transactions

This incident emphasizes the risks associated with address copying and partial verification in crypto transactions. Unlike software vulnerabilities, address poisoning exploits user habits, particularly reliance on transaction history and partial address checks.

Security experts encourage crypto users to verify full wallet addresses carefully, use hardware wallets, and double-check recipients before sending large amounts. Such preventive measures are vital to reduce the likelihood of losses from social engineering and phishing-style attacks.

The case is attracting attention in the crypto community, illustrating both the sophistication of modern scams and the measures victims are willing to take to recover stolen assets. Legal authorities and blockchain investigators may also monitor the case to explore avenues for asset recovery.