Crypto Scam Alert: How a Copy-Paste Wallet Mistake Cost $50M

In the constantly evolving world of cryptocurrency, one of the biggest ongoing threats for traders and investors is address spoofing scams — where attackers trick users into sending funds to the wrong wallet. A recent on-chain incident highlighted by on-chain analytics account Lookonchain shows just how costly these mistakes can be. X (formerly Twitter)

What Happened? A $50 Million Mistake

According to the Lookonchain alert, a victim identified only by a partial wallet address (starting with 0xcB80…) lost approximately $50 million because of a malicious wallet spoofing attack. X (formerly Twitter)

Here’s how it happened:

Copy-Paste Address Error:
The victim copied what they thought was their own wallet address. However, the scammer had created a spoofed wallet with the same first and last four characters. X (formerly Twitter)
Address Poisoning Attack:
The scammer used an address poisoning technique — a form of social engineering where a malicious address is inserted into clipboard history or suggestions so that users accidentally paste it instead of their intended address. The scammer likely used tools that overwrite copied addresses or appear in the clipboard as legitimate. X (formerly Twitter)
Transfer to Scammer Wallet:
The victim then unknowingly transferred a huge amount of funds to the attacker’s address. The misuse of a copied address resulted in a loss of tens of millions of dollars in cryptocurrency. X (formerly Twitter)

What Is Address Poisoning?

Address poisoning is a type of crypto scam where a hacker replaces a legitimate wallet address in a user’s clipboard with the attacker’s wallet address. When a user pastes a wallet address during a transfer, they accidentally paste the attacker’s address instead of the intended one.

Since cryptocurrency transactions are irreversible once broadcast to the blockchain, the funds are immediately lost if the wrong address is used — with no central authority to reverse the flow.

Why This Scam Works

Crypto wallets and exchanges often rely on users manually copying and pasting addresses. Unfortunately:

Wallet addresses are long and complex
Most users only check the beginning and end of the address
Some malicious tools or sites can overwrite clipboard data
Scammers exploit human trust in copy-paste accuracy

In this case, the scam was especially effective because the spoofed wallet mimicked the exact first and last characters of the legitimate wallet, making the fake address difficult to detect by quick visual inspection.

How Users Can Protect Themselves

Although scams like this are difficult to completely eliminate, there are several best practices that can help reduce risk:

1. Always Double-Check Wallet Addresses

Don’t rely on clipboard data. Manually verify the entire address or use QR codes where possible.

2. Use Wallet Tools With Built-In Protections

Some modern wallets include anti-phishing features that detect known bad addresses or match entire address strings.

3. Avoid Copying from Untrusted Sources

Never copy wallet addresses from emails, unknown websites, or shared chats unless absolutely confirmed.

4. Use Hardware Wallets

Hardware wallets reduce the risk of clipboard manipulation because they offer transaction confirmation on a separate physical device.

Final Thoughts

Crypto remains one of the most exciting financial frontiers, but it also carries unique digital risks. Address spoofing and clipboard poisoning scams have cost traders millions in losses, and many victims never recover their funds.

Awareness and best practices remain the most powerful defense against these increasingly sophisticated attacks.