According to Chainalysis, a large holder withdrew 50 million USDT from Binance, aiming to move funds discreetly. Minutes later, a test transfer of 50 USDT went to an address crafted to resemble the recipient’s, matching the first and last three digits. When the actual transfer was executed, the full 50 million USDT arrived at the scammer’s near-identical address, indicating a spoofing tactic designed to misdirect the counterparty.

The perpetrator promptly converted the windfall into DAI to reduce tracing risk, then purchased ETH (16,624 ETH). The funds were subsequently laundered through Tornado Cash to obfuscate provenance, highlighting persistent on-chain obfuscation methods used in large-value fraud. The report underscores the need for enhanced recipient verification and robust internal controls at custodians and exchanges to mitigate spoofing risks and rapid chain-hopping of stolen assets.