A crypto investor lost $2.6 million worth of stablecoins in two nearly identical phishing attacks within a span of three hours, underscoring a growing and sophisticated threat in blockchain-based finance: zero-transfer scams.
The incident, flagged on May 26 by crypto security firm Cyvers, involved two large transactions of Tether (USDT) - the first totaling $843,000, followed hours later by a second transfer of $1.75 million. In both cases, the victim appears to have fallen for a deceptive onchain tactic known as a zero-value transfer, a phishing method increasingly deployed by scammers targeting user habits around wallet addresses.
This double loss highlights the limitations of current user-facing wallet interfaces, the rise of intelligent social engineering in crypto crime, and the urgent need for robust security solutions across Web3.
Zero-value transfers exploit a flaw in how users interpret transaction history and trust wallet addresses. The technique abuses the ERC-20 token standard's transferFrom function, which allows any party to initiate a token transfer without user consent - if the amount is zero.
Because no real tokens are moved, these spoofed zero-value transactions do not require a digital signature from the target wallet. They are nonetheless recorded on-chain, often misleading victims into believing the spoofed address is a previously trusted one.
In effect, scammers "poison" a victim’s transaction history by injecting benign-looking zero-value transfers that appear legitimate. When the victim later goes to make a real transaction - perhaps using wallet history or copying a previously interacted-with address - they may accidentally send funds to the attacker’s spoofed address.
This exploit draws from and extends a related attack method called address poisoning, where scammers send small amounts of cryptocurrency from wallet addresses designed to look visually similar to a user's known contacts. This typically relies on exploiting the user’s reliance on partial address matching - often the first and last four characters - rather than verifying the full string.
Advanced Phishing
The key danger behind zero-transfer and address poisoning scams lies not in breaking cryptographic protocols but in manipulating user behavior. Crypto wallet interfaces - especially browser-based wallets and mobile apps - often surface address histories and past transactions as indicators of safety, trust, or previous usage. This creates an attack surface that doesn’t depend on vulnerabilities in code, but rather in human decision-making.
In the case of the recent $2.6 million theft, the victim likely used their wallet’s transaction history to initiate or verify the address, believing they were sending funds to a known or previously trusted contact. The repetition of the attack in under three hours suggests the victim either did not detect the initial loss in time or believed the first transaction was legitimate - both scenarios pointing to how stealthy and convincing the scam can be in real-time.
The losses were exclusively in USDT (Tether), a widely used stablecoin with billions in daily onchain volume. Because USDT is typically used in large institutional and retail transfers, it's become a prime target for precision scams that focus on high-value wallets.
Poisoning Attacks on the Rise
The incident is not isolated. A comprehensive study released in January 2025 revealed that over 270 million address poisoning attempts were recorded across Ethereum and BNB Chain between July 2022 and June 2024. Though only 6,000 of those attacks were successful, they collectively accounted for over $83 million in confirmed losses.
The sheer volume of attempts - successful or not - suggests that poisoning strategies are cheap to execute and remain effective due to the behavioral tendencies of users and the lack of anti-phishing UX in common crypto wallets.
Notably, the scale of damage in individual cases is significant. In 2023, a similar zero-transfer scam led to the theft of $20 million in USDT, before Tether eventually blacklisted the wallet. However, blacklisting is not a universal safeguard - many tokens don’t support issuer blacklists, and not all blockchain networks offer similar intervention tools.
AI Detection Tools and Interface Overhauls
In response to the rise of zero-transfer phishing, several cybersecurity and wallet infrastructure firms are attempting to mitigate the risks through smarter detection systems.
Earlier this year, blockchain security firm Trugard partnered with onchain security protocol Webacy to introduce an AI-based detection system specifically designed to flag potential address poisoning attempts. According to its developers, the tool has demonstrated a 97% accuracy rate in tests involving historical attack data.
The system works by analyzing patterns in transaction metadata, transfer behavior, and address similarities, then alerting users before a transaction is finalized. However, broader adoption across popular wallets remains limited, as many platforms are still in the process of integrating third-party security tools.
Some wallet developers are also exploring changes to how transaction histories are presented. For example, flagging zero-value transactions, coloring addresses based on trust scores, and making full address verification easier are being considered as ways to disrupt scam success rates. But until such interface changes become standardized across the industry, users remain exposed.
Legal and Regulatory Blind Spots
While zero-transfer scams are technologically simple, legal action against perpetrators is complex and rarely successful. Many of these scams originate from pseudonymous or foreign entities, with funds quickly laundered through decentralized exchanges, mixers, or cross-chain bridges.
Stablecoin issuers like Tether can intervene only when centralized control mechanisms exist - and only if the stolen funds remain untouched or traceable. Once attackers move funds into privacy pools or convert them into other assets, clawback becomes virtually impossible.
Additionally, law enforcement agencies often lack the technical expertise or jurisdictional reach to investigate such attacks unless they’re part of larger organized campaigns.
The Final Line of Defense
For the time being, end users must adopt heightened caution when interacting with blockchain addresses - particularly for large-value transfers. Best practices include:
- Always verifying the full address, not just the first/last characters.
- Avoiding the use of wallet history for copying addresses.
- Manually bookmarking known addresses from official sources.
- Using wallets with built-in phishing detection, when available.
- Monitoring zero-value incoming transfers as potential red flags.
The rise in zero-transfer phishing attacks demonstrates a shift in Web3 threats from protocol-level hacks to social engineering attacks using onchain metadata. As the value of assets on public blockchains grows, so too will the sophistication of these methods - making user education and better wallet tooling critical for protecting funds.