Address Poisoning Costs 140 ETH (~$636k) — Recovery Unlikely, Prevention Critical

I report that a user fell victim to an address-poisoning attack and accidentally sent 140 ETH, a loss of roughly $636,000. I find this a stark example of how small UX or security failures can lead to catastrophic losses in crypto.

I believe the attack likely involved clipboard or browser-based address replacement, malicious extensions, or a lookalike ENS/QR vector. Recovery chances are low once funds are moved, but immediate tracing and reporting can help if the funds are still on-chain and unmixed.

I urge others to treat this as a reminder to always verify addresses using multiple methods, send test transactions for new payees, use hardware wallets and address whitelists, keep software updated, and report incidents promptly to wallet providers and law enforcement.