User loses about $305K in DAI after copying a poisoned lookalike address from history
A DAI holder sending to a regular counterparty
On 4 October 2026 GoPlus Security flagged a loss of about $305,000 in DAI. The attacker made an address with the same first and last characters as the victim's usual recipient, sent dust transfers so it appeared in the victim's history, and the victim copied it for a large transfer. GoPlus warned these campaigns are now fully automated, from finding targets to laundering. Reports did not name the chain.
Why this severity: $305K reported stolen, 1 victims, still active.
- Started
- Oct 4, 2026
- Chains
- Multiple EVM chains
- Method
- Address poisoning
- Reported stolen
- $305K
- Victims
- 1
Indicators · never visit or send to these
- 0x085ccc21065c8c718fa0afcb4e842f247c18f1dd
What to do now
- Check the full recipient address of your recent large transfers against a saved, trusted copy.
- A transfer to a poisoned address cannot be reversed. Report the address to the exchanges it touches and to police quickly, in case funds can be stopped downstream.
Stay safe
Am I affected?
If you often send to the same addresses and your history shows tiny or zero-value transfers from addresses that look like your contacts, you are being targeted. The danger is copying one of those addresses.
What to do now
- Check the full recipient address of your recent large transfers against a saved, trusted copy.
- A transfer to a poisoned address cannot be reversed. Report the address to the exchanges it touches and to police quickly, in case funds can be stopped downstream.
How to avoid this
- Never copy an address from your transaction history or an explorer list. Use a saved address-book entry or get it fresh from the recipient.
- Compare the whole address, not just the first and last few characters.
- Send a small test amount and have the recipient confirm it before a large transfer.
- Turn on your wallet's filter for zero-value and dust transfers if it has one.
Timeline 2
News & write-ups ›2
How this method works
The attacker sends you a tiny or fake transfer from an address that looks like one you use, hoping you copy it from your history next time you send. Read about address poisoning →
Follow new drains and updates in your feed reader or Telegram RSS bot.