Crypto Scam Leads to $50M USDT Theft on Ethereum

On Ethereum, an address-poisoning scam led to the theft of nearly $50 million in USDT from a single wallet. Funds rapidly converted to DAI and then into ETH before entering Tornado Cash, eliminating traceability. “Attacker swapped USDT to DAI through MetaMask, then to ETH, and deposited the ETH into Tornado Cash to break traceability.”

The victim remains unidentified while attackers used an externally owned account to execute the theft via a spoofed wallet address. No entity has claimed the loss as of current updates.

The event, marked as one significant operational error, underscores vulnerabilities in crypto transfer processes. Funds converted to non-freezeable assets prevented Tether interventions and highlighted systemic risk concerns.

This incident highlights address-poisoning as a rising threat in crypto security. It also led to discussions on wallet user experience and transaction verification protocols within the crypto industry. User withdrew nearly 50M USDT from Binance, did a 50 USDT test, then mistakenly copied a poisoned address from history and sent the remaining 49,999,950 USDT to the attacker.

The attack has shown how quickly funds can be laundered using decentralized paths without traceability. It urges users to adopt advanced verification techniques to mitigate risks.

Potential technological adjustments might include enhanced wallet UX, greater use of whitelists, and protocols to prevent similar future cases, influenced by regulatory and industry pressures.