Address Poisoning: How a $50 Test Led to a $50 Million Crypto Loss

On December 20, 2025, a crypto holder did what security guides recommend. They sent a $50 test transaction to their cold storage address and watched it arrive. Minutes later they sent the rest, $49,999,950 in USDT, to an address that only looked like the right one.

The scam is called address poisoning. A Bullrunners video walks through how it works, why cold storage and test transactions did not stop it, and why the stakes are even higher for XRP holders. It ends with a one-minute check anyone can run on their own wallet history.

What is address poisoning?

Address poisoning is a scam that plants a fake, lookalike address in your transaction history so you copy it by mistake. It relies on the fact that crypto addresses are long and hard to read.

The largest study of the scam comes from Carnegie Mellon University researcher Taro Tsuchiya and colleagues, published at the USENIX Security Symposium in 2025. The paper describes an Ethereum address as a “hardly memorable” 40-digit hexadecimal string. Nobody memorizes that, so people copy addresses from somewhere, very often from their own list of past transactions.

The attack works in three steps, according to the paper as described in the video:

1. The attacker watches the blockchain and sees you send funds to an address.
2. The attacker generates a different address whose first and last characters match the one you used. The paper calls this a lookalike address.
3. The attacker sends you a tiny amount from that lookalike, so it now sits in your history right next to the real one.

The paper also notes that most wallet software used to show only the first and last three to five characters of an address. The middle, which is usually hidden, is exactly where the two addresses differ.

How big is the problem?

The Carnegie Mellon team found more than 270 million attack attempts aimed at more than 17 million victims on Ethereum and Binance Smart Chain between July 1, 2022 and June 30, 2024. Of those, 6,633 attempts worked, taking at least $83.8 million in total.

On Ethereum, the paper puts the success rate at about 0.01%, or roughly one try in 10,000. That sounds like a failing scam, but the bait is cheap. The paper found that 98.79% of the tiny bait transfers were worth less than $3. An attacker can send thousands of them for little cost, and a single hit on the right wallet pays for all of it. The paper calls it one of the largest cryptocurrency phishing schemes observed in the wild.

Victims are not random. According to the paper, targets were more likely than typical stablecoin users to have higher balances at the time of the attack, more transactions, and larger transfers. In plain terms, the larger your balance and transfers, the more likely a lookalike is already in your history.

Does a hardware wallet stop address poisoning?

No. A hardware wallet protects your private keys, but it cannot know which address you meant to send to. A hardware wallet is a physical device, such as a Ledger or Trezor, that keeps your private keys offline. That protects against a long list of attacks. But as the video puts it, the device signs for the address you hand it, and it does that perfectly.

Ledger tells users to always trust the address shown on the device screen. The video points out the limit of that advice: the screen accurately shows the address you pasted. If you paste the lookalike, the device displays the lookalike honestly and asks you to confirm. It did its job; it just protected the wrong address.

Ledger’s own guide to this scam makes the same point. It advises checking the full transaction address, not just the first and last few characters, and comparing it against a trusted source. The video stresses that last phrase: once anyone can write into your transaction history, your history is no longer a trusted source.

Safety habit	What it protects	What it does not check
Hardware wallet	Your private keys	Whether the address is the one you meant
Device screen check	That the signed address matches what you pasted	Where the pasted address came from
Test transaction	That an address can receive funds	Whether you copy the same address again
Copying from history	Nothing	Whether a lookalike was planted

Why did the $50 test transaction backfire?

The test worked, but it marked the exact moment and address the attacker needed. CoinDesk reported that the victim sent the $50 test to confirm the destination before moving the rest.

The video explains the problem: a test transaction writes the real address into your history with a fresh timestamp, right when a large transfer is about to follow. According to the same report, within minutes a lookalike matching the first and last characters was generated, and a tiny payment from it landed in the victim’s history.

Trezor, another hardware wallet maker, warns its customers about this exact scenario. Its guidance says sending a small amount first is a popular method, and it is precisely the situation where people are tempted to copy an address from their transaction history. The victim went back to the history to copy the address they had just tested. Two entries matched at both ends. They checked the start and the end, and the money went to the wrong one.

Can stolen USDT or XRP be recovered?

Sometimes stablecoins can be frozen, but XRP cannot be clawed back. Stablecoins such as USDT are issued by companies, and those issuers can freeze funds in a way the video compares to a bank holding a check. A witness at a House Financial Services Committee hearing in April 2025 noted that stablecoins are freezable midstream. The video reports that, according to Binance’s founder, one person recovered $20 million of USDT from a lookalike address in August 2023. The video calls that luck, not something anyone can plan on.

XRP works differently. The video plays a clip of David Schwartz, speaking when he was Ripple’s chief technology officer, explaining that stablecoins are produced by institutions and subject to clawback and freeze, while the XRP Ledger has no government running it. The XRP Ledger documentation states that XRP is not a token and cannot be clawed back.

The video frames this as both a feature and a cost. Nobody can seize your XRP by pressing a button, which is part of why many holders choose it. But if you send XRP to a lookalike, there is no issuer to call and no freeze. The payment is final the moment the ledger accepts it.

Which habit actually causes the loss?

The habit is copying the destination address from your own transaction history. According to the video, neither the hardware wallet nor the test transaction caused these losses. Cold storage protects your key, and a test proves an address works. Neither checks where the address you paste came from.

The video describes your transaction history as a public notice board rather than a private record. Anyone who sends you anything can pin a note to it. The attacker never needs your keys, password or device, only one line in your history. Tsuchiya, in a clip in the video, suggests not copying and pasting every time, checking every digit, or whitelisting the addresses you intend to use. The host adds that rushing is a common trigger, and that slowing down matters whether the amount is a hundred dollars or millions.

The 1-minute address poisoning wallet check

The video offers a quick check you can run now, plus habits for your next large transfer.

1. Open the wallet you send from and look at incoming transactions.
2. Look for tiny or zero-amount transfers from addresses you do not recognize.
3. Compare those addresses with ones you actually use. If one starts and ends the same as a real address, treat it as a poisoning attempt.
4. Do not interact with it, and do not send anything back to it.
5. For your next large transfer, get the address from the original source, never from your history.
6. Save the addresses you send to in your wallet’s address book.
7. After a test transaction, copy the address again from the same original source, not from the test you just sent.
8. Check every character on the device screen against that source, including the middle.

The video estimates this adds about one minute to a transfer.

What to check next

Run the incoming-transaction check on every wallet you use to send funds, especially wallets that have recently made large transfers, since the research suggests those are targeted more often. Look at how your wallet displays addresses and whether it hides the middle characters. Set up an address book for regular destinations. If you hold XRP, keep in mind that the ledger offers no clawback, so the address check before you confirm is the only safeguard you have.