Ilia Zavialov

Sending and receiving USDT safely

Ilia Zavialov on USDT transfers: the wrong network, address poisoning, frozen coins and dirty funds

English version for the United States.

Ilia Zavialov on sending and receiving USDT safely: why the network matters as much as the address, how address poisoning plants a copy in your history, what happens when the issuer freezes coins and why peer to peer deals bring dirty funds. In December 2025 one victim sent about 49,999,950 USDT to a planted address 26 minutes after a correct test transfer. The FBI recorded more than 11.3 billion dollars of losses with a crypto element in 2025. A one minute routine prevents most of these mistakes.

·9 min read·Ilia Zavialov

Ilia Zavialov on why most USDT losses happen in the seconds before pressing send.
Copying from history is the step the attacker waits for.

01Why USDT is where so many losses happen

USDT is a stablecoin: a token designed to be worth one US dollar. People use it to pay freelancers, to move savings across borders, to trade on exchanges and to settle deals with strangers. It is simple to send and it arrives in minutes.

The same qualities make it the currency of choice for fraud. A transfer cannot be reversed, the sender sees only an address, and most of the mistakes that cost money happen in the few seconds before pressing send.

This guide covers the four problems that cause most losses with USDT: choosing the wrong network, sending to a poisoned address, receiving coins that later get frozen, and trading with strangers for cash or bank transfers.

None of these requires technical knowledge to avoid. Each has one or two checks that take less than a minute.

The same checks apply whether the amount is fifty dollars or fifty thousand. Habits formed on small transfers are the ones that hold when the amount is large and the pressure is high.

02The network matters as much as the address

USDT exists on several blockchains at once. The same token can be sent through different networks, and an exchange usually asks the user to choose one when withdrawing.

Sending through a network that the receiving wallet or exchange does not support can make the funds unreachable or require a slow and paid recovery by the exchange. Fees also differ widely between networks.

The rule is to copy the network name from the receiving side, together with the address, and to check that both match before sending. If the recipient cannot tell you the network, the transfer should wait.

For a first transfer to a new address, send a small test amount and ask the recipient to confirm it arrived. Then send the rest from a freshly copied address, which leads to the next problem.

Exchanges usually show the supported networks next to the deposit address. If the network you plan to use is missing from that list, stop and ask the exchange before sending anything.

Every safe habit adds seconds, every risky one saves them.
Four ways USDT transfers go wrong, the sign and the check that prevents it
ProblemWhat it looks likeCheck that prevents it
Wrong networkFunds do not arrive or are stuckCopy network and address from the recipient
Address poisoningA similar address in your historyNever copy from history, compare in full
Frozen coinsDeposit blocked by the exchangeAccept only from identified counterparties
Dirty funds in P2PPayment reversed or account frozenEscrow and payer's own named account
Cash dealFake notes or robbery riskAvoid large cash meetings
No recordsCannot explain funds to the exchangeKeep agreements and chats
Four steps, none of them technical.

03Address poisoning: the copy that looks right

Address poisoning is a trick aimed at people who copy addresses from their transaction history. The attacker creates an address that starts and ends with the same characters as one you use, and sends a tiny or zero value transfer from it to your wallet.

The fake address now sits in your history next to the real one. The next time you copy the address from history instead of from the source, you may copy the fake one.

The damage can be enormous. In December 2025 a victim sent about 49,999,950 USDT to a planted address 26 minutes after a 50 dollar test transfer. The test went to the right address, the main transfer to the copy.

Attackers watch the blockchain for large balances and active wallets, so the tiny transfer appears soon after a normal operation. Its arrival is itself a warning that someone is targeting the wallet.

The rule is to never copy an address from transaction history, to use an address book with labeled contacts, and to compare the whole address, every character, before every large transfer.

04When the issuer freezes the coins

The company that issues USDT can freeze tokens on specific addresses, and it does so at the request of law enforcement and when addresses are linked to fraud or sanctions. A frozen balance cannot be moved.

This protects victims in some cases, and it also creates a risk for anyone who receives coins from an unknown source. If the address that paid you is later linked to fraud, exchanges may block the deposit and ask where the funds came from.

The rule is to accept USDT only from counterparties you can identify, and to keep records of every deal: the agreement, the chat, the invoice. A clear record is what an exchange asks for when it reviews a blocked deposit.

A frozen balance can sometimes be released after an investigation, but the process is slow and depends on the issuer and the authorities. It is not a guarantee that a victim will recover anything.

05Dirty coins and peer to peer deals

Many people buy or sell USDT directly with strangers through peer to peer platforms, chats or couriers with cash. The risk sits in what arrives on the other side.

A buyer may pay you with money stolen from another victim, then the victim's bank reverses the payment or freezes your account. A seller may send coins taken from a fraud, which later get flagged.

Cash deals add the risk of fake banknotes and robbery. Meetings arranged in chats with people who insist on large amounts of cash are the least protected way to exchange money.

The rule is to use platforms with escrow and dispute procedures, to accept payment only from an account in the counterparty's own name, and to walk away from any deal that asks you to hurry or change the payment method midway.

06Fake wallets, fake exchanges and fake support

Some losses happen before any transfer. A fake wallet application from an advert or a link in a chat looks like a real one, but it sends the recovery phrase to its authors the moment it is created or imported.

Fake exchanges and investment platforms ask for deposits in USDT because the transfer cannot be reversed. The balance on the screen grows, and the withdrawal never comes, or comes only after a fee paid in USDT again.

Fake support is the third route. Someone who answers a question in a public chat offers help in private messages and asks for the recovery phrase or a connection to a website that approves a withdrawal of all tokens.

The rule is to install wallets only from the official store page linked from the project's own site, never to type a recovery phrase into any website or chat, and to treat anyone who asks for it as the attacker.

07Being paid in USDT for work or goods

Freelancers and sellers increasingly accept USDT. The risks on the receiving side are different: fake payment screenshots, overpayments that must be refunded, and coins from addresses linked to fraud.

A screenshot of a transfer proves nothing. Check the incoming transaction in your own wallet or on a blockchain explorer, and deliver the work or goods only after the funds are confirmed.

An overpayment with a request to return the difference to another address is a known scheme. Return funds only to the address they came from, and only after they are confirmed and cleared.

Keep invoices and correspondence. If an exchange later asks where the coins came from, a clear record of an ordinary deal is the fastest way to unblock the deposit.

08The larger picture

By the Chainalysis count, fraud on public blockchains took no less than 14 billion dollars during 2025, while a typical payment to a scam address became 253 percent larger than a year before. Transfers are getting fewer and bigger.

Stablecoins are the preferred currency for these payments because their value does not move. A fraudster who receives USDT does not need to worry about the price falling before the funds are moved on.

That is also why checks before a USDT transfer matter more than checks before a card payment. There is no chargeback and no bank to call afterwards.

Losses with a crypto element now make up more than half of all losses reported to the FBI, which shows how central stablecoins and other crypto assets have become to fraud as a whole.

09What the numbers show in the United States

The FBI Internet Crime Complaint Center recorded 11,366,669,732 dollars of losses with a cryptocurrency element in 2025 across 181,565 complaints, more than half of all losses it recorded that year.

Crypto investment fraud alone accounted for 61,559 complaints and 7.228 billion dollars of losses, with complaints up 48 percent. In most of these cases the victim bought stablecoins or other crypto and sent them to an address controlled by the fraudster.

Report losses to the FBI at ic3.gov with transaction hashes and addresses, and contact the exchange that processed the transfer immediately. Fast reports give the issuer and exchanges a chance to freeze funds.

10A one minute routine before every transfer

Copy the address and the network from the recipient's original source, never from history.

Compare the whole address character by character, or use a labeled address book entry created after a confirmed test transfer.

Send a small test amount to any new address and wait for confirmation from the recipient through a separate channel.

Keep a record of who you paid and why. It costs nothing and it is the first thing an exchange or an investigator will ask for.

11Questions and answers

What happens if I send USDT through the wrong network?

The funds may become unreachable or require a slow and paid recovery by the receiving exchange. Copy the network from the recipient together with the address and check both.

What is address poisoning?

An attacker sends a tiny transfer from an address that looks like one you use, so that the fake address appears in your history. Never copy addresses from history.

Can USDT be frozen?

Yes. The issuer can freeze tokens on addresses linked to fraud or sanctions, and exchanges may block deposits from such addresses. Accept USDT only from counterparties you can identify.

Is a test transfer enough?

It confirms the address you sent to. The main transfer must go to the same address, copied from the source and compared in full.

Where do I report a USDT loss in the US?

To the FBI at ic3.gov with transaction hashes, and immediately to the exchange that processed the transfer.

Written by Ilia Zavialov, digital security consultant. Profile of Ilia Zavialov

12Read next

Back to the blog