The good phisher: How a USDT holder lost and recovered $129m within hours

A crypto investor lost a substantial amount of USDT tokens to a phishing address but eventually witnessed a return of the funds hours later. 

Data from Tronscan shows that the user with the wallet address “TGr…XAE” mistakenly transferred $129 million in USDT to a phishing address on the TRON blockchain. 

The phishing address, “THc…bu8,” mimicked the appearance of the intended recipient, “TMS…bu8,” by using similar starting and ending characters. 

The victim had initially tested the transaction with 100 USDT before sending the massive sum but failed to notice the discrepancy in addresses when transferring the $129 million.

Notably, the erroneous transfer occurred at 09:05 UTC. A few minutes later, the phishing address moved the stolen funds to a new wallet, “TKt…f6m.” At this point, the stolen funds seemed lost forever. 

However, in an unexpected move, the holder of “TKt…f6m” returned 90% of the stolen funds — 116.7 million USDT — to the victim’s address at 09:58 UTC. Nearly five hours later, the remaining balance of 12.96 million USDT was also sent back to the victim.

Immediately after the investors received the assets, the victim transferred the funds to their original intended destination, “TMS…bu8,” where the tokens have remained since. 

The motives behind this unusual act of restitution remain unclear. Speculation ranges from a rare display of benevolence by the phishing gang to other factors influencing their decision.

This case is an anomaly in the growing trend of crypto-related phishing scams. Last month, an address tied to a prominent crypto venture capital firm lost $36 million in a similar attack. 

In August, a whale lost $55 million in a phishing scam involving DAI stablecoin. According to reports from crypto.news, phishing scams cost investors $63 million in August and $43 million in September.