Investor Loses 2.6 Million USD Stablecoin Due to Double Phishing Fraud, Highlighting Risks from "Zero-Value Transfer" and "Address Poisoning" Techniques
A crypto investor was recently scammed out of a total of 2.6 million USD stablecoin (USDT) in just three hours, after becoming a victim of a sophisticated double phishing attack. According to data from blockchain security company Cyvers, the victim inadvertently made two transactions, transferring 843,000 USDT and then 1.75 million USDT to the scammer's wallet.
The attack method used was the "zero-value transfer" technique – an upgraded variant of "address poisoning". Specifically, the fraudster exploited on-chain transaction display functions by creating fake transactions transferring 0 tokens from the victim's wallet to their address.
Although these transactions did not cause asset loss, they were recorded on the blockchain without the victim's digital signature, appearing as legitimate in the transaction history.
Exploiting psychological factors and the habit of copying addresses from transaction history, the scammer made the victim mistakenly believe their address was a previously transacted wallet. Copying the wrong address and subsequently sending assets led to serious financial damage.
This technique is considered a new advancement in address poisoning methods, which previously used fake wallet addresses with similar first and last characters to deceive users. The incident also recalls a similar event in 2023, when an attacker used the "zero-transfer" technique to steal 20 million USDT – which was subsequently blacklisted by Tether.
According to a study published in January 2025, over 270 million address poisoning attempts were recorded on blockchains like Ethereum and BNB Chain from July 2022 to June 2024. Among these, approximately 6,000 attacks were successful, causing estimated damages exceeding 83 million USD.
Facing increasingly complex developments, security companies like Trugard and wallet protection platform Webacy have collaborated to develop an AI-powered address poisoning detection tool. According to tests, this system achieves up to 97% accuracy, opening new prospects in efforts to prevent increasingly sophisticated fraud in the digital asset space.
