140 ETH Lost to Address Poisoning — Harden Ethereum Security Now

I’m alarmed that a user lost 140 ETH (about $636,000) to an address poisoning attack — a costly reminder that on-chain transactions are final and mistakes are often irreversible.

I believe this incident likely involved clipboard or UI manipulation (malicious extension, phishing site, or local malware) replacing a copied address with an attacker’s address. These attacks exploit routine copy-paste behaviour and can succeed against even experienced users.

I recommend treating this as a wake-up call: stop using compromised endpoints, move remaining assets using an offline/hardware signer, verify addresses with multiple methods, and adopt small test transfers and whitelisting to prevent repeating this mistake.