qerranews 
Double Phishing Scam Hits
In an alarming case that underscores the evolving threats in the cryptocurrency world, a single investor fell victim to a double phishing scam within just three hours, resulting in a loss of $2.6 million in stablecoins. The incident, reported on May 26 by blockchain compliance firm Cyvers, highlights the growing menace of sophisticated onchain phishing tactics, especially the increasingly common zero-value transfer method.
The attack occurred in two phases. Initially, the investor transferred $843,000 worth of Tether (USDT), followed by a second transfer of $1.75 million just a few hours later—both sent to a scammer’s address. The underlying technique used to deceive the victim relies on advanced manipulations of transaction history and user trust in previously interacted wallet addresses.
What Is Zero-Value Transfer?
Zero-value transfers represent a deceptive method of onchain phishing, exploiting how token transfers appear in a user’s transaction history. Here’s how it works: the attacker sends a zero-amount transaction from the victim’s wallet to a fraudulent address. This doesn’t require the victim’s signature, as no actual funds are being moved. However, it still gets logged on the blockchain.
Once this spoofed transaction appears in the victim’s wallet history, the address may seem familiar or trustworthy due to its presence in past activity. The unsuspecting user may later initiate a real transaction, copying what they believe is a legitimate address—when in fact, it’s the attacker’s wallet. This simple psychological trick can be devastating, especially when large sums of crypto assets are involved.
Evolution of Address Poisoning
The zero-value transfer is an advanced variant of the well-known address poisoning technique. In traditional address poisoning, an attacker sends a tiny amount of cryptocurrency from a wallet address that closely resembles one the user frequently transacts with—often by mimicking the first and last few characters of a known wallet.
Users who don’t double-check the full address may mistakenly use the attacker’s address in subsequent transactions, leading to a permanent loss of funds. In combination with zero-value transfers, attackers create a multi-layered deception that manipulates both visual similarity and trust from transaction history.
This method is particularly effective due to human reliance on partial address recognition, copy-paste habits, and general trust in past activity logs. With stablecoins like USDT, often used for large transfers or holdings, the stakes are incredibly high.
Phishing Threats on the Rise
The scale of this threat is far from isolated. A study published in January 2025 reported over 270 million address poisoning attempts across major blockchains like BNB Chain and Ethereum between mid-2022 and mid-2024. Out of these, approximately 6,000 attacks were successful—resulting in over $83 million in stolen assets.
Recognizing the escalating problem, security firms like Trugard and Webacy have collaborated to launch an AI-based detection system designed to spot and prevent address poisoning and zero-transfer scams. Tested against thousands of known attacks, this tool claims a 97% success rate, offering hope for improved security measures in an otherwise vulnerable crypto investing environment.
How to Stay Safe
For crypto investors, especially those handling large volumes of stablecoins, vigilance is no longer optional—it’s essential. Here are a few best practices to avoid falling prey to these evolving scams:
- Double-check wallet addresses: Never rely on the first and last few characters. Always verify the full address before sending any funds.
- Avoid copy-paste habits: Use hardware wallets or trusted contact lists instead of copying addresses from previous transactions or chats.
- Monitor transaction history critically: Just because an address appears in your transaction history doesn’t make it safe.
- Use wallet security tools: Implement phishing detection and blockchain security software designed to recognize malicious behavior.
- Enable transaction alerts: Use real-time alerts to track any outgoing transaction, even zero-value transfers.
With scams becoming more advanced, awareness and technological support are key to protecting your crypto portfolio.
Final Thoughts
The $2.6 million loss serves as a stark reminder of how sophisticated scammers in the crypto space have become. As stablecoins grow in popularity for both trading and savings, the potential for high-stakes fraud only increases. Whether you’re a novice or an experienced investor, staying ahead of emerging threats is crucial in navigating the volatile world of digital assets.