incident 2026-06-03
AddressesAddress poisoning: the lookalike in your history
At 10:02 UTC an operations lead at a small fund sent a 10 USDC test payment to an OTC desk. Ninety seconds later a zero-value transfer appeared in the fund's history, to an address with the same first and last four characters. The main payment of 250,000 USDC went to that address 39 minutes later.
timeline utc
39 minutes from test to loss
- 10:02The fund sends 10 USDC to the desk at 0x3d8e…b71f to test the route before the main payment.
- 10:03A bot calls transferFrom for 0 USDC from the fund to a new address that also shortens to 0x3d8e…b71f.
- 10:41The desk confirms the test, and the lead copies the top address from history and sends 250,000 USDC to the lookalike.
- 10:44The attacker swaps the USDC for ETH and splits it across 30 fresh addresses.
- 11:20The desk reports that nothing arrived, and the fund finds two entries with the same short address in its history.
Nobody typed a wrong character. The lead copied the address from the wallet's own history, where the planted entry looked like a payment the fund had made itself.
The attack is cheap. A rented GPU finds an address that matches eight hex characters in less than a minute, and many tokens accept a transferFrom of zero from any address, so the plant needs no allowance from the victim.
what a check would have shown
The same request, read by Presign
- Lookalike of an address you paid today
- Its only history is a zero-value transfer
- First real payment to this address
app.swapzone.exampleethereum · mainnet
3 flags03 / flagsapprove(spender, amount)
- Unlimited allowanceThe spender can move every USDC you hold, now or later.
- New contractThe spender was deployed 3 days ago.
- Unverified sourceIts code is not published, so nobody can read it.
The wallet showed eight characters out of forty, and the attacker only had to match those. We compare all forty before you send.
