A cryptocurrency investor has lost 4,556 Ethereum, worth about $12.4 million, after falling victim to an address poisoning scam involving a fake look-alike wallet address.
The incident was flagged by Specter, a pseudonymous blockchain analyst, who said the theft occurred around 32 hours after the attacker first interacted with the victim’s wallet.
According to on-chain data, the attacker initially sent a small “dust” transaction to the victim to manipulate the wallet’s transaction history.
Address poisoning scams exploit the way users visually verify wallet addresses by checking only the first and last characters.
In this case, the attacker created a vanity address that closely matched the legitimate over-the-counter settlement address used by the victim.
The fraudulent address shared the same starting and ending characters as the intended destination, making it appear authentic at a glance.
Specter said the attacker monitored the victim’s wallet activity for nearly two months before executing the theft.
During this period, the attacker identified a frequently used deposit address linked to large OTC transactions.