Two Ethereum wallets have recorded a $62 million loss in January and December months owing to “copy-paste” scams. ScamSniffer reported that in December 2025, a trader lost about $50 million after accidentally sending funds to a fake address copied from their transaction history.
Subsequently, just a month later, another user made the same error and lost around $12.25 million, or roughly 4,556 ETH at the time.
The scams come against the larger backdrop of Ethereum being one of the most affected blockchains in the current ecosystem. According to a year-end study by SlowMist, the Ethereum ecosystem suffered considerable losses from hacks and scams in 2025, with Ethereum being the most affected blockchain, accounting for around $254 million in direct security event costs.
Understanding “copy-paste” scams
According to the report, both instances followed a similar pattern. The funds were sent to bogus locations concealed inside the victims’ most recent activity records.
The new form of “copy-paste” scams, also called Address poisoning attacks, have surfaced as a silent threat to the industry. The scam operates with hackers using tricks to exploit users by making them engage with wallet addresses the way they typically interact in normal transactions.
Attackers watch blockchain transactions and create fake addresses that look similar to real ones, often called “vanity addresses.”
They then send tiny, almost negligible amounts of crypto, sometimes called “dust”, to potential targets. The small transactions show up in the victim’s transaction history, making it easy for users to mistakenly copy the wrong address when sending funds.
In the guise of legitimate addresses, these scams increase the risk of big losses to users who do not thoroughly verify addresses prior to sending crypto.
The attack is a clever and subtle method for siphoning cryptocurrency through perfectly ordinary and lawful wallet use.
The recent incidents suggest that small mistakes during crypto trading may result in a loss of millions of dollars. Experts stress that people should double-check their wallet addresses to implement tighter security measures, especially during operations with big funds of digital currencies. The incidents serve as a reminder of the risks of working with the Ethereum network and other similar systems, where ordinary operations may become costly.
ScamSniffer highlights rise of signature-based phishing attacks
Separately, ScamSniffer has pointed out the subtle but noticeable rise of signature-based phishing attacks with January seeing one of the biggest spikes in activity.
According to the report, 4,741 users lost a total of $6.27 million, marking a 207 percent jump from December. Shockingly, just two wallets were behind around 65 percent of the total losses.
The biggest attacks included $3.02 million in SLVon and XAUt tokens, and another $1.08 million from aEthLBTC-all using malicious permits and increased allowance approvals.
The attacks work by duping their victims into unknowingly giving scammers ways to obtain their money, and that’s where the care has to be applied when approving crypto transactions, which should even go down to wallet actions that seem routine.
The incidents are based upon falsified transaction prompts that appear quite ordinary. Once users sign them, criminals have long-term access to tokens and can drain cash without additional consent.
But security experts say the attacks work because the schemes target habits learned during regular trading, rather than technical loopholes in the protocols themselves.