Address poisoning: user loses ~$305k DAI to lookalike dust address
04 Oct 2026: GoPlus reported a user lost about $305k DAI after copying a lookalike address from transaction history. Attackers had dusted the victim from an address matching the real recipient's prefix and suffix.
GoPlus describes the pipeline as automated: target finding, lookalike generation, and mixer laundering. User-side loss, Rhymes with earlier large poisoning cases.
Research snapshot from PANews / TokenPost / ChainCatcher flashes citing GoPlus.
369 take
Copy-paste from recent history is the kill step.
Pulse lesson: for large sends, paste the destination from your own address book or QR, then check first and last characters against a known-good source.
Never trust a fresh inbound dust address that almost matches someone you already paid.
Sources