Crypto Users Lost $472,000 Due to Fake Addresses and Phishing Signatures

Published: October 5, 2026 – 08:14 UTC

A user lost around $305,000 in DAI due to an address poisoning attack.
In another case, a victim lost $167,342 in LINK after signing a malicious Permit2 approval.
Experts urged users not to copy crypto addresses from transaction history and to carefully review signatures before confirming.

A user lost around $305,000 in DAI as a result of an address substitution (address poisoning) attack. GoPlus Security experts reported this.

GoPlus Security Alert: User lost ~$305K DAI to an #AddressPoisoning attack.Attack flow: adversary dusts the victim from a lookalike address (prefix + suffix match), then waits for a copy-paste error from tx history.These campaigns are fully automated — target discovery, spoofed same-name fake tokens or dust poisoning, then mixer laundering.Victim:0xb6bce73e112e566cf04742f003e1d82fd7f6b7bfIntended recipient:0x085adc5a4a1227b1c8aab9a962c03676fa18f1ddPoison address:0x085ccc21065c8c718fa0afcb4e842f247c18f1ddTx: https://t.co/sKcyCiDRU4 Never copy addresses from tx history. Verify the full address. Always send a small test tx before size.
— GoPlus Security (@GoPlusSecurity) October 4, 2026

They explained that the attacker first sends the victim a micro-transfer (“dust”) from an address with a similar prefix and suffix. The idea is that the user will later copy the address from their transaction history without fully verifying it.

In this case, the intended recipient address was 0x085adc…18f1dd, while the attackers used a lookalike address, 0x085ccc…18f1dd.

GoPlus Security noted that such campaigns can be fully automated. Attackers automate target discovery, the creation of clone tokens with the same names, dust transfers, and subsequent laundering through mixers.

The company urged users not to copy addresses from transaction history and to verify them in full before sending. Users are also advised to run a small test transaction first before transferring significant amounts.

Another $167,000 lost due to Permit2

A separate incident was reported by Scam Sniffer. A user lost $167,342 in LINK tokens after signing a phishing Permit2 approval on the Ethereum network.

According to the service, the approval was signed on August 18, 2025. However, the attackers moved the user’s assets on October 3 of the following year.

Onchain Matrix noted that this case highlights the risks associated with signing Permit2, when a user unknowingly grants a malicious approval access to their assets without understanding the consequences.

According to analysts, clearer warnings during transactions and message signing could help prevent similar losses.

The total amount lost across the two incidents described exceeds $472,000.

As a reminder, in March 2026, Trust Wallet added an address poisoning protection feature to combat fraud.

Сообщение Crypto Users Lost $472,000 Due to Fake Addresses and Phishing Signatures появились сначала на INCRYPTED.

Source: Incrypted