$12.4M Ethereum lost in “address poisoning” attack

[cryptoenthusiast]

A crypto investor accidentally sent 4,556 ETH to a look-alike wallet engineered by an attacker. The hacker used a vanity address mimicking the victim’s OTC deposit address—matching the first and last characters.

After dusting the wallet with a small transaction, the fake address appeared in the victim’s recent activity, tricking them into sending millions. This is the second eight-figure theft via this method in weeks.

Experts warn: don’t rely on recent transaction lists for high-value transfers—use verified, hard-coded addresses instead.

[kevin1]

institutional investors being told to whitelist and verify every high-value transfer… feels like common sense but clearly not enough

[JanEmil]

Small mistake. Big impact ,-(