On December 19, 2025, a "Toxin Tagger" detection tool built by ++Carnegie Mellon's CyLab researchers++ caught a live attack in progress: a trader lost roughly $50 million in USDT to a spoofed address crafted to match the first three and last four characters of the real destination, close enough to pass a routine visual check. It's the same research group whose ++USENIX Security paper++ had already documented 270 million address-poisoning attempts targeting 17 million victims across Ethereum and Binance Smart Chain between July 2022 and June 2024, with $83.8 million in confirmed losses in that two-year window specifically. The December incident happened well over a year after that dataset closed, a separate, later event their own detection work happened to catch.
This is a transaction-level fraud that hits anyone sending or receiving crypto payments, merchants included, and it needs its own set of defenses.
The risk most merchant guides skip: receiving tainted funds
A merchant accepting crypto faces a risk that has nothing to do with losing money directly. A payment can arrive from a wallet that's already flagged, tied to a sanctioned entity, a darknet market, or laundering activity, and the merchant may not find out until much later.
++FATF's Recommendation 16 guidance++ treats identifying originator information as a core obligation for any business handling crypto transfers. A merchant who unknowingly accepts a payment from a flagged wallet can face frozen funds, a banking relationship put under review, or regulatory scrutiny, none of it caused by anything the merchant did wrong at the point of sale.
This is exactly the problem tools like ++Elliptic++ exist to solve for payment-accepting businesses, not just exchanges. Elliptic's screening products, Lens for real-time wallet risk scoring and Navigator for ongoing transaction monitoring, run checks against sanctions lists, darknet market activity, and known illicit clusters across more than 65 blockchain networks. ++Elliptic's own reporting++ states that two-thirds of global crypto trading volume is transacted on exchanges that already rely on its screening tools, with more than 700 customers across 30 countries screening over a billion transactions weekly. This kind of screening is standard at the exchange level, but merchant-facing payment acceptance often skips it entirely, treating screening as something only exchanges need.
Address poisoning: how a $50 million mistake actually happens
Address poisoning works by exploiting a habit almost everyone has: copying a wallet address from transaction history instead of typing or scanning it fresh each time. As CyLab's researchers put it, wallet addresses are 40-character hexadecimal strings that are effectively impossible to memorize, so most wallets and blockchain explorers display only the first and last few characters, and most people copy from history rather than verify the full string.
An attacker generates a lookalike address that shares those visible first and last characters with a legitimate one a target has transacted with before, then sends a small, worthless transaction from that lookalike address to plant it in the victim's transaction history. When the victim later goes to send funds and grabs what looks like the right address from their recent history, they're actually copying the attacker's planted address instead.
This is how the December 2025 incident unfolded, and the transaction itself was completely valid, signed correctly, and confirmed exactly as intended. It just went to the wrong place, and once confirmed on-chain, there's no reversing it.
How to actually verify a wallet address before sending
Given how the attack works, the defense has to happen before the transaction, not after. A few concrete habits close most of the gap:
- Never copy an address from transaction history for a new or infrequent recipient. Get the address fresh, directly from the recipient, each time.
- Check the full string, not just the ends. Lookalike addresses are built specifically to match what's visible at a glance; comparing the entire 40-character string, or at minimum several segments across its length, catches what a first-and-last-few-characters check misses.
- Use QR codes or saved contacts where available. Both remove the manual copy-paste step entirely, which is the actual point of failure in nearly every address-poisoning case.
- Be cautious with test transactions on high-value transfers. A small test send is common advice, but CyLab's research notes some attacker groups now monitor the network specifically for test transactions and react before the larger transfer follows, so a test transaction alone isn't a complete safeguard.
- Whitelist addresses for recurring counterparties so future payments don't require re-verifying or re-copying anything at all.
Keys: operational wallet security for a business
This is a different question from which custody model a business chooses overall, covered in more depth in our custody decision guide. Here the focus is narrower: whatever custody model a merchant uses, what operational controls actually prevent day-to-day loss?
Whitelisting known, verified addresses for recurring payments removes the address-poisoning risk almost entirely for repeat transactions, since a whitelisted address doesn't need to be copied from history each time. Segregating operational funds, what's needed for near-term spending, from reserve holdings kept in cold storage limits how much is ever exposed to a single compromised device or session. Requiring multiple approvals above a set transaction size, similar in spirit to the shared-control model covered in the custody guide, adds a check that a single compromised staff account can't bypass alone.
Controls: a practical checklist
- Screen incoming payments against sanctions and illicit-activity databases before treating funds as clean, not after a problem surfaces.
- Whitelist addresses for any recurring counterparty rather than relying on copying from transaction history each time.
- Verify full address strings manually for any new or high-value destination, rather than relying on the first and last few characters matching.
- Segregate operational and reserve funds, keeping only what's needed for near-term use outside cold storage.
- Set approval thresholds so no single person can move funds above a defined size without a second sign-off.
- Separate staff access levels, so wallet-viewing permissions and transaction-approval permissions aren't held by the same account by default.
Related reading: Pay-by-Crypto for B2B · Custodial vs Non-Custodial Crypto: A Business Decision Guide · How Pay-by-Crypto Works for B2B: Settlement, Chargebacks and Reconciliation