Address Poisoning Attack Leads to 100,000 DAI Loss, GoPlus Security Says

5 mins mins

GoPlus Security has reported that a user lost 100,000 DAI after falling victim to an address poisoning attack, a scam technique that exploits transaction history to trick victims into sending funds to a lookalike wallet address.

The claim, attributed to blockchain security firm GoPlus Security, describes a scenario in which the victim copied a recipient address from their transaction history without verifying the full string. The reported loss amounts to roughly $100,000, given that DAI is a stablecoin pegged to the U.S. dollar.

The incident remains only partially verified. Available evidence includes an Etherscan address page linked to the case, but independent confirmation of the full attack chain has not been completed.

How Address Poisoning Tricks Wallet Users

Address poisoning is a social-engineering attack that targets how people interact with their transaction history. An attacker sends a small or zero-value transaction to a victim’s wallet from an address that closely resembles one the victim has previously used.

The lookalike address typically shares the same first and last few characters as the legitimate recipient. Because many wallet interfaces truncate addresses in history views, the fraudulent entry can appear identical to a real one.

When the victim later wants to send funds, they copy what they believe is a familiar address from their history. Instead, they paste the attacker’s lookalike address. The funds go directly to the scammer’s wallet. This method is particularly effective with stablecoin transfers like DAI, where users frequently send to the same addresses and rely on history for convenience.

The technique has been documented in multiple reports on address poisoning scams across Ethereum and other EVM-compatible chains. Similar attacks have also targeted users on BNB Chain, where projects like the ERC-8004 identity framework aim to improve how addresses and identities are managed on-chain.

What On-Chain Evidence Can and Cannot Confirm

Blockchain explorers like Etherscan can confirm that a transfer of 100,000 DAI occurred from one address to another. The transaction hash, timestamp, sender, and receiver are all publicly visible and immutable.

However, on-chain data alone cannot prove the social-engineering mechanism behind a transfer. There is no way to determine from the blockchain whether the sender intended to send to that address, was tricked by a lookalike, or made an unrelated error.

GoPlus Security’s attribution of the loss to address poisoning is based on pattern analysis, not a confirmed victim statement in the available evidence. The research underlying this report flagged incomplete verification, and the full attack path from poisoning transaction to victim mis-send has not been independently traced in published sources.

This type of verification gap is common in crypto security incidents. Even in cases involving larger losses, such as the recent TAC bridge attack that cost $2.8 million, confirming the exact attack vector often requires combining on-chain evidence with off-chain reporting.

How To Avoid Address Poisoning Scams

The most important defense is to never copy a recipient address from transaction history alone. Even if an address looks correct at a glance, the truncated display in most wallets can hide critical differences in the middle characters.

Use a saved address book or contacts feature within your wallet software. Most major wallets, including MetaMask and hardware wallet interfaces, support labeled address lists that bypass history entirely.

Before confirming any high-value transfer, verify the full address character by character. For transfers above a few hundred dollars, sending a small test transaction first and confirming receipt with the intended recipient adds a layer of protection.

Be skeptical of unexpected small incoming transactions from unknown addresses. These are often the “poison” transactions designed to plant a lookalike address in your history. Some wallet interfaces now flag these suspicious micro-transactions, but the feature is not universal.

Broader market volatility can compound the damage of scams like these. During periods of heavy ETF-driven outflows and inflows, increased transaction volumes across DeFi create more opportunities for attackers to target active wallets.

FAQ

What is an address poisoning attack?

An address poisoning attack is a scam in which an attacker sends a small transaction from a wallet address that closely mimics a legitimate address the victim has used before. The goal is to trick the victim into copying the fake address from their transaction history and sending funds to the attacker.

Can blockchain explorers prove an address poisoning scam happened?

Blockchain explorers can confirm that a transfer occurred and show the sender, receiver, amount, and timestamp. They cannot prove that the sender was tricked by a lookalike address. Confirming address poisoning requires matching a suspicious small inbound transaction with the subsequent large outbound transfer to the same attacker-controlled address.

How can users verify a recipient address before sending DAI or other tokens?

Always verify the full address string, not just the first and last few characters. Use your wallet’s address book feature to save verified addresses. For large transfers, send a small test amount first and confirm receipt before sending the full balance.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.