Recently, one of the biggest losses from on-chain scams occurred. An address poisoning attack, a fraud that takes advantage of how account-based blockchains manage transaction history and address reuse, caused a single user to lose almost $50 million in USDT.
Charles Hoskinson's comment
According to Charles Hoskinson, it would not have occurred on some architectures that are inherently more resilient to errors of this nature. This is how it came about.
Shortly after the money was taken out of Binance, the victim’s wallet, which had been active for about two years and was mostly used for USDT transfers, received close to $50 million. The user sent a brief test transaction to the intended recipient, which is what many would consider safe behavior. The full amount was sent a few minutes later. The incorrect address was used for that second transfer.
Earlier, the scammer had carried out an address poisoning attack by sending a small amount of USDT from a wallet designed to look like a real address the victim had previously used. The victim mistakenly chose the poisoned address rather than the correct one when they copied the address from the transaction history. As a result, $50 million was lost with just one click.
Why UTXO is better in these cases
Although it is probably going to be moved or exchanged, the stolen USDT is currently still at the destination address.
"This is another reason UTXO is awesome," Hoskinson said in response to the incident. He is not wrong. The account-based model that Ethereum and many other EVM chains employ directly leads to this type of scam. Addresses are displayed as free-form strings in transaction history, and wallets promote copying from previous exchanges. That is precisely what hackers take advantage of.
Chains like Bitcoin and Cardano that are based on the UTXO model function differently. Every transaction produces new outputs while consuming existing ones. Wallets usually create transactions from explicit UTXO selections rather than reused account endpoints, and users do not rely on copying destination addresses from account histories in the same manner. A persistent account state to visually poison does not exist.
This was not a protocol flaw or an exploit for smart contracts. It was a flaw in the design that interacted with human nature, and in less than an hour, it cost $50 million.
