Crypto sees $62M losses as address poisoning tricks users

How wallet errors and phishing led to $62M crypto losses

Two crypto users lost $12.25 million and $50 million after copying incorrect wallet addresses, as reported by CryptoPotato. The combined $62 million shows how a single copy‑paste mistake can escalate into a permanent on‑chain loss. In each case, a misaddressed transfer moved funds to an unintended destination with no practical recourse.

Address poisoning, a tactic that plants a look‑alike address in a victim’s recent activity so it is later copied by mistake, is emerging as one of crypto’s costliest scams, according to Invezz. Attackers exploit routine behaviors, not necessarily software vulnerabilities.

Operational errors at exchanges are a separate risk category from user‑side phishing. South Korean regulators opened investigations into Bithumb after the exchange accidentally sent roughly $43 billion worth of Bitcoin due to an internal error, as reported by Decrypt. That incident reflects institutional processing failure, whereas address poisoning and copy‑paste errors are user‑initiated pathways.

Why it matters now and immediate steps to prevent losses

These incidents matter now because losses stem from everyday workflows like copying a recipient from a chat or a recent‑activity list. Strengthening basic verification around destination addresses can meaningfully lower exposure.

Risk‑reducing practices include validating the entire destination string from an independent, trusted source and avoiding reliance on recently seen addresses. Many platforms offer address allowlists and transaction alerts, and a small test transfer can confirm that a new address behaves as expected. Private keys and seed phrases should never be shared, and unsolicited “support” contacts warrant extreme skepticism.

Platform guidance echoes these safeguards and cautions against social‑engineering lures masquerading as urgent account problems. “Coinbase will never ask you for your login credentials, API key or two‑factor authentication codes. Nor will we ask you to transfer funds,” said Jaclyn Sales, Director of Communications at Coinbase. The emphasis is on verifying requests and channels before taking any action that could move assets.

At the time of writing, NasdaqGS delayed quote data indicated the stock ticker COIN closed near $165.12 on 6 February, with after‑hours levels around $165.86. Figures were flagged as delayed and are provided for context rather than transaction guidance. Market levels do not alter the mechanics of address verification, but they frame the environment in which operational and phishing risks materialize.

Address poisoning explained: how look-alike addresses trick senders

In an address‑poisoning setup, an attacker generates an address that visually resembles a legitimate payee and then sends a small or zero‑value transaction so the decoy appears in the victim’s history. Later, when the victim copies an address from prior activity, the look‑alike gets selected instead of the intended one. Because blockchains finalize transfers without name checks, the funds follow the spoofed string exactly.

Simple mitigations focus on source integrity and end‑to‑end comparison. Obtain the recipient address directly from the intended counterparty through a verified channel, then compare every character before committing the transaction; where available, use saved allowlists and perform a nominal test transfer before sending the principal.