One investor lost $2.5 million in stablecoins within just three hours after falling victim to a double phishing attack
According to blockchain security firm Cyvers, the attacker first lured the victim into sending $843,000 worth of Tether (USDT). Just hours later, the same victim unknowingly sent an additional $2.6 million USDT—this time to the same spoofed wallet address used in the earlier attack. This one-two punch is a textbook case of “address poisoning,” a deceptive trick that manipulates transaction histories to earn misplaced trust.
At the heart of this scam is a clever abuse of how crypto wallets display transaction history. Attackers initiate a transaction using the transferFrom function of a token contract, sending zero tokens to the victim’s wallet from a lookalike or spoofed address. Since no funds move, the blockchain doesn’t require the victim’s signature, but the transaction still appears in their history.
Later, when the victim wants to move real funds—say to a trusted address—they may mistakenly select the spoofed address from their past transactions. That’s where the trap is sprung: the attacker receives real funds, and the victim is left with a devastating loss. This tactic is gaining traction.
In 2021, a crypto investor named Brian lost $78,000. It was after falling for a sophisticated crypto phishing scam involving a fake Ledger device. Despite following all security best practices, he received a counterfeit “replacement” Ledger in the mail, supposedly due to a past data breach.
The device was pre-loaded with malware and tricked him into entering his recovery phrase. This scam, rooted in social engineering and stolen customer data. It shows that even cold wallets aren’t foolproof without proper verification steps.
The information discussed by Altcoin Buzz is not financial advice. This is for educational, entertainment, and informational purposes only. Any information or strategies are thoughts and opinions relevant to the accepted risk tolerance levels of the writer/reviewers, and their risk tolerance may differ from yours. We are not responsible for any losses you may incur due to any investments directly or indirectly related to the information provided. Bitcoin and other cryptocurrencies are high-risk investments, so please do your due diligence. Copyright Altcoin Buzz Pte Ltd.
The Bitget hacker has moved about $83 million in stolen XRP from three wallets, while roughly $75 million remains across the original accounts that cannot be frozen on the XRP Ledger.
XRP
A whitehat moved 3,832 NFTs from hundreds of wallets into protective custody after concerns surfaced about a Magic Eden vulnerability.
KelpDAO has sued LayerZero Labs and co-founder Bryan Pellegrino in British Columbia over the April 18, 2026 exploit of 116,500 rsETH worth about $292 million.
ETHTHIS LEDGER CAN STEAL YOUR MONEY Brian did everything right: cold wallet, secure setup, no phishing. BUT a fake “replacement” Ledger drained his crypto in minutes. Here’s how the scam works and how to protect your crypto 🧵👇
