A blockchain security service called CertiK reports that on May 3, an address-poisoning attack cost a cryptocurrency user more than $69.3 million in wrapped Bitcoin (WBTC). Prior to stealing the WBTC in the subsequent transaction, the attacker first replicated a 0.05 Ethereum (ETH) transfer.

The report was confirmed by crypto security service Cyvers and on-chain investigator ZachXBT. The instance was "probably the highest value lost due to an address poisoning scam," according to Cyvers CTO Meir Dolev.

An address poisoning scam involves tricking victims into sending money to an exploiter by using a similar wallet address. The four to six characters at the start and finish of an address are often mimicked by the malicious address.

Users are susceptible to this technique since it can be difficult to distinguish the differences at times, particularly when wallet addresses can contain more than 40 alphanumeric characters.

The event has now surpassed the $25.7 million in digital assets that were obtained over the course of the past month through scams and vulnerabilities. Additionally, according to CertiK, April witnessed the lowest levels of defi scams since 2021.