What happened to the $2.7M?
A threat actor reported that after successfully stealing $2.7M, the same actor accidentally routed the entire sum to a look-alike wallet address that was controlled by a different scammer. The incident was posted on the DWC users channel on Telegram.
How did the second scam unfold?
The second actor, who had set up a wallet address that differed from the original by only a single character, received the stolen funds. The address was not the intended destination; it belonged to a separate fraud operation that had been active in the same network.
Why did the first actor send to the wrong address?
The source does not provide a motive, but the rapid transfer suggests a lack of address verification. The actor may have copied the address from a compromised source or mistyped a single character.
What can users verify to avoid similar mistakes?
- Compare the full hexadecimal string of the destination address with the one displayed in the wallet interface.
- Use a blockchain explorer to confirm that the address exists and has a history of legitimate activity.
- If possible, scan the QR code with the wallet app rather than typing the address manually.
Immediate protective action for readers
If you have recently sent funds to an address that looks suspicious or was entered manually, check the transaction on a reputable explorer. If the funds have already moved, contact the exchange or wallet provider to see if a reversal is possible, though most blockchains do not allow that.
What does this mean for the broader crypto community?
The incident highlights that even actors who have already engaged in theft are vulnerable to basic operational errors. It underscores the need for strict address verification protocols, especially when handling large sums.
How to spot a look-alike address
Look-alike addresses often differ by a single character or a small sequence. Pay attention to the case of letters and the presence of ambiguous characters such as 'O' vs '0' or 'I' vs '1'.
What to do if you suspect a scam
Report the address to the platform you used, and if the funds were sent to a known exchange, contact their support. Many exchanges have a process for flagging suspicious transactions.
Related security guidance
For more on securing crypto payrolls and avoiding tax pitfalls, see our guide on Cardano ADA Payroll: Navigating Volatility, Tax, and Security.
How the theft was executed
The initial theft occurred on a private channel where the attacker moved $2.7M from a victim wallet to an intermediary address. The attacker claimed to have used a compromised private key that had been leaked in a previous breach. The transfer was completed in a single transaction, indicating a high level of technical proficiency.
The address-poisoning scam in detail
After the theft, the attacker attempted to move the stolen funds to a new destination. Instead of the intended address, the transaction was sent to a wallet that differed by a single character. The new address was controlled by a separate fraud ring that had been active in the same blockchain ecosystem. The ring had previously targeted users with similar look-alike addresses, siphoning funds from unsuspecting senders.
Implications for wallet operators
Wallet providers should enforce stricter address validation. Implementing checks that flag addresses that differ by a single character from known legitimate addresses can reduce the risk of accidental transfers. Additionally, integrating QR code scanning with real-time address verification can prevent manual entry errors.
What to watch next
Crypto exchanges and wallet services are likely to update their user interfaces to display full address strings in a more prominent manner. Users should monitor updates from major wallet providers for new verification features.