Scammer Mysteriously Losses Stolen $129 Million USDT After Successful Phishing Scam

In the rapid circumstances of development in the crypto world lately, the ‘men of the underworld’ appear to also want a share of the recent price rallies. A crypto user was recently lucky to have recovered some stolen $129 million worth of USDT in unexpected fashion.

However, the mystery behind the funds return was eventually explained by crypto scam tracking firm Scam Sniffer. A report by Scam Sniffer on November 20 showed that the user was attempting to complete a transaction on the TRON framework when the scammer led the user to transfer the funds to the wrong address. 

It is believed that the phishing scam was successful because the scammer’s wallet address bore close similarity with the original recipient’s address. The original wallet address was “TMS…bu8” which has the same ending characters as the scammer’s wallet address, THc…bu8.”

After carrying out a test transfer with $100 USDT to verify the authenticity of the recipient wallet address, the user was unable to detect any anomalies. The user went on to transfer $129 million worth of USDT to the wallet address of the phishing scammer. 

However, to the surprise of every party who followed the development, in less than an hour after the incident, the scammer refunded the user with $116.7 worth of USDT. After about four hours, the scammer would refund the remaining $12.96 million in USDT. After the refund, the user wasted no time in transferring the funds to the legitimate wallet address. 

While the motivation for the scammer’s decision to refund the funds remains a matter of speculation, it is worth noting the rise in the cases of phishing attacks.

As described by Scam Sniffer, the phishing strategy deployed in this scam attack is the “address-poisoning method.” The method involves scammers creating wallet addresses that are very similar to those owned by victims. The created wallet addresses would only differ by a few characters, usually in a less conspicuous position. This method has been used to siphon over crypto assets worth over $800 million in 2024 alone, CertiK reports.