The Good Samaritan Phisher: How a USDT Holder Lost and Recovered $129 Million in Hours
A significant cryptocurrency investor recently experienced the loss of a substantial amount of USDT tokens due to a phishing scam, but was able to recover the funds within hours.
On the TRON blockchain, data from Tronscan reveals that the user, with the wallet address "TGr...XAE," mistakenly transferred $129 million in USDT to a phishing address. The fraudulent address, "THc...bu8," closely resembled the intended recipient's address, "TMS...bu8," using similar starting and ending characters, leading to the error.
The investor had initially tested the transaction by transferring 100 USDT to ensure everything was in order, but failed to notice the slight discrepancy in the address when sending the massive sum. The erroneous transfer took place at 09:05 UTC, after which the phishing address swiftly moved the funds to a new wallet, "TKt...f6m," making it appear as if the funds were permanently lost.
Unexpectedly, within minutes, at 09:58 UTC, the holder of the "TKt...f6m" wallet returned 90% of the stolen funds—116.7 million USDT—to the original victim's wallet. Remarkably, by 14:54 UTC, the remaining balance of 12.96 million USDT was also returned, completing the restitution.
Upon receiving the funds, the investor immediately transferred the assets to their intended recipient, the address "TMS...bu8," where the tokens have remained.
The motivations behind this surprising act of restitution are unclear, with speculation ranging from a rare gesture of goodwill by the phishing entity to other potential influencing factors.
This case stands in stark contrast to the growing number of crypto-related phishing scams. Last month, a wallet linked to a well-known crypto venture capital firm was defrauded of $36 million in a similar attack. In August, a crypto whale lost $55 million in a phishing scam involving the DAI stablecoin. According to crypto.news, phishing scams cost investors $63 million in August and $43 million in September.
