Sending and receiving USDT safely
Ilia Zavialov on USDT transfers: the wrong network, address poisoning, frozen coins and dirty funds
English version for the United States.
Ilia Zavialov on sending and receiving USDT safely: why the network matters as much as the address, how address poisoning plants a copy in your history, what happens when the issuer freezes coins and why peer to peer deals bring dirty funds. In December 2025 one victim sent about 49,999,950 USDT to a planted address 26 minutes after a correct test transfer. The FBI recorded more than 11.3 billion dollars of losses with a crypto element in 2025. A one minute routine prevents most of these mistakes.
01Why USDT is where so many losses happen
USDT is a stablecoin: a token designed to be worth one US dollar. People use it to pay freelancers, to move savings across borders, to trade on exchanges and to settle deals with strangers. It is simple to send and it arrives in minutes.
The same qualities make it the currency of choice for fraud. A transfer cannot be reversed, the sender sees only an address, and most of the mistakes that cost money happen in the few seconds before pressing send.
This guide covers the four problems that cause most losses with USDT: choosing the wrong network, sending to a poisoned address, receiving coins that later get frozen, and trading with strangers for cash or bank transfers.
None of these requires technical knowledge to avoid. Each has one or two checks that take less than a minute.
The same checks apply whether the amount is fifty dollars or fifty thousand. Habits formed on small transfers are the ones that hold when the amount is large and the pressure is high.
02The network matters as much as the address
USDT exists on several blockchains at once. The same token can be sent through different networks, and an exchange usually asks the user to choose one when withdrawing.
Sending through a network that the receiving wallet or exchange does not support can make the funds unreachable or require a slow and paid recovery by the exchange. Fees also differ widely between networks.
The rule is to copy the network name from the receiving side, together with the address, and to check that both match before sending. If the recipient cannot tell you the network, the transfer should wait.
For a first transfer to a new address, send a small test amount and ask the recipient to confirm it arrived. Then send the rest from a freshly copied address, which leads to the next problem.
Exchanges usually show the supported networks next to the deposit address. If the network you plan to use is missing from that list, stop and ask the exchange before sending anything.
| Problem | What it looks like | Check that prevents it |
|---|---|---|
| Wrong network | Funds do not arrive or are stuck | Copy network and address from the recipient |
| Address poisoning | A similar address in your history | Never copy from history, compare in full |
| Frozen coins | Deposit blocked by the exchange | Accept only from identified counterparties |
| Dirty funds in P2P | Payment reversed or account frozen | Escrow and payer's own named account |
| Cash deal | Fake notes or robbery risk | Avoid large cash meetings |
| No records | Cannot explain funds to the exchange | Keep agreements and chats |
03Address poisoning: the copy that looks right
Address poisoning is a trick aimed at people who copy addresses from their transaction history. The attacker creates an address that starts and ends with the same characters as one you use, and sends a tiny or zero value transfer from it to your wallet.
The fake address now sits in your history next to the real one. The next time you copy the address from history instead of from the source, you may copy the fake one.
The damage can be enormous. In December 2025 a victim sent about 49,999,950 USDT to a planted address 26 minutes after a 50 dollar test transfer. The test went to the right address, the main transfer to the copy.
Attackers watch the blockchain for large balances and active wallets, so the tiny transfer appears soon after a normal operation. Its arrival is itself a warning that someone is targeting the wallet.
The rule is to never copy an address from transaction history, to use an address book with labeled contacts, and to compare the whole address, every character, before every large transfer.
04When the issuer freezes the coins
The company that issues USDT can freeze tokens on specific addresses, and it does so at the request of law enforcement and when addresses are linked to fraud or sanctions. A frozen balance cannot be moved.
This protects victims in some cases, and it also creates a risk for anyone who receives coins from an unknown source. If the address that paid you is later linked to fraud, exchanges may block the deposit and ask where the funds came from.
The rule is to accept USDT only from counterparties you can identify, and to keep records of every deal: the agreement, the chat, the invoice. A clear record is what an exchange asks for when it reviews a blocked deposit.
A frozen balance can sometimes be released after an investigation, but the process is slow and depends on the issuer and the authorities. It is not a guarantee that a victim will recover anything.
05Dirty coins and peer to peer deals
Many people buy or sell USDT directly with strangers through peer to peer platforms, chats or couriers with cash. The risk sits in what arrives on the other side.
A buyer may pay you with money stolen from another victim, then the victim's bank reverses the payment or freezes your account. A seller may send coins taken from a fraud, which later get flagged.
Cash deals add the risk of fake banknotes and robbery. Meetings arranged in chats with people who insist on large amounts of cash are the least protected way to exchange money.
The rule is to use platforms with escrow and dispute procedures, to accept payment only from an account in the counterparty's own name, and to walk away from any deal that asks you to hurry or change the payment method midway.
06Fake wallets, fake exchanges and fake support
Some losses happen before any transfer. A fake wallet application from an advert or a link in a chat looks like a real one, but it sends the recovery phrase to its authors the moment it is created or imported.
Fake exchanges and investment platforms ask for deposits in USDT because the transfer cannot be reversed. The balance on the screen grows, and the withdrawal never comes, or comes only after a fee paid in USDT again.
Fake support is the third route. Someone who answers a question in a public chat offers help in private messages and asks for the recovery phrase or a connection to a website that approves a withdrawal of all tokens.
The rule is to install wallets only from the official store page linked from the project's own site, never to type a recovery phrase into any website or chat, and to treat anyone who asks for it as the attacker.
07Being paid in USDT for work or goods
Freelancers and sellers increasingly accept USDT. The risks on the receiving side are different: fake payment screenshots, overpayments that must be refunded, and coins from addresses linked to fraud.
A screenshot of a transfer proves nothing. Check the incoming transaction in your own wallet or on a blockchain explorer, and deliver the work or goods only after the funds are confirmed.
An overpayment with a request to return the difference to another address is a known scheme. Return funds only to the address they came from, and only after they are confirmed and cleared.
Keep invoices and correspondence. If an exchange later asks where the coins came from, a clear record of an ordinary deal is the fastest way to unblock the deposit.
08The larger picture
By the Chainalysis count, fraud on public blockchains took no less than 14 billion dollars during 2025, while a typical payment to a scam address became 253 percent larger than a year before. Transfers are getting fewer and bigger.
Stablecoins are the preferred currency for these payments because their value does not move. A fraudster who receives USDT does not need to worry about the price falling before the funds are moved on.
That is also why checks before a USDT transfer matter more than checks before a card payment. There is no chargeback and no bank to call afterwards.
Losses with a crypto element now make up more than half of all losses reported to the FBI, which shows how central stablecoins and other crypto assets have become to fraud as a whole.
09What the numbers show in the United States
The FBI Internet Crime Complaint Center recorded 11,366,669,732 dollars of losses with a cryptocurrency element in 2025 across 181,565 complaints, more than half of all losses it recorded that year.
Crypto investment fraud alone accounted for 61,559 complaints and 7.228 billion dollars of losses, with complaints up 48 percent. In most of these cases the victim bought stablecoins or other crypto and sent them to an address controlled by the fraudster.
Report losses to the FBI at ic3.gov with transaction hashes and addresses, and contact the exchange that processed the transfer immediately. Fast reports give the issuer and exchanges a chance to freeze funds.
10A one minute routine before every transfer
Copy the address and the network from the recipient's original source, never from history.
Compare the whole address character by character, or use a labeled address book entry created after a confirmed test transfer.
Send a small test amount to any new address and wait for confirmation from the recipient through a separate channel.
Keep a record of who you paid and why. It costs nothing and it is the first thing an exchange or an investigator will ask for.
11Questions and answers
What happens if I send USDT through the wrong network?
The funds may become unreachable or require a slow and paid recovery by the receiving exchange. Copy the network from the recipient together with the address and check both.
What is address poisoning?
An attacker sends a tiny transfer from an address that looks like one you use, so that the fake address appears in your history. Never copy addresses from history.
Can USDT be frozen?
Yes. The issuer can freeze tokens on addresses linked to fraud or sanctions, and exchanges may block deposits from such addresses. Accept USDT only from counterparties you can identify.
Is a test transfer enough?
It confirms the address you sent to. The main transfer must go to the same address, copied from the source and compared in full.
Where do I report a USDT loss in the US?
To the FBI at ic3.gov with transaction hashes, and immediately to the exchange that processed the transfer.
Written by Ilia Zavialov, digital security consultant. Profile of Ilia Zavialov
12Read next
- Ilia Zavialov Explains How a Crypto Transfer Actually Works, Step by Step How crypto works
- Ilia Zavialov Explains the Types of Crypto Scams and How Each One Is Built Scam types
- Ilia Zavialov on the Crypto Wallet Protections That Hold After a Breach Protection
- Ilia Zavialov on the First Hours After a Crypto Theft: What Actually Helps Incident
- Where Fraud Losses Actually Go: Ilia Zavialov Reads the 2025 Numbers In numbers
- Ilia Zavialov on cloud mining scams: what a hosting contract really sells Mining you never see
- Ilia Zavialov fraud: how one photograph becomes the face of an advert nobody filmed A face from one photo
- Ilia Zavialov on crypto exchange scams: how the operation is built and what litigation achieves How exchange scams are built
- Ilia Zavialov on the fee to unlock a withdrawal and what a real exchange delay looks like Blocked withdrawals
- Services that promise to recover lost crypto: Ilia Zavialov on how the offer is built and why refunds never arrive Crypto recovery
- Ilia Zavialov on crypto investment scams: the long con taken apart stage by stage The long investment con
- Ilia Zavialov on passkeys: why a stolen password stops being worth anything Signing in without a password
- Ilia Zavialov on reviews of financial companies: what to check before the stars Reviews and what to check instead
- Ilia Zavialov on the seed phrase and the fake wallet support desk Seed phrases
- Ilia Zavialov on crypto signal channels and trading bots: where the money goes Signal channels and trading bots
- Checking a wallet address before you send: the checks Ilia Zavialov runs first Wallet checks
- Ilia Zavialov Explains How an Approval Drainer Empties a Wallet Wallet drainers