This seems to be what’s known as an address poisoning attack. It works like this:
The attacker picks an address that has been used multiple times and holds a considerable amount of money (over 5 BTC in this case). They then craft an address using a brute-force search that they control but that begins and ends with the same characters as the victim’s address, and from this special address send the victim a small amount of money. The hope is that the next time the victim wants to use their address they copy it from their transaction history and accidentally copy the attacker’s address, who then receives funds intended for the victim.
Some ways you can protect yourself from this attack:
- Don’t reuse addresses.
- Don’t copy addresses from your transaction history.
- Always check every character of your address, not just the start and end.
