- Published on
A 0 USDC or USDT transfer from your wallet that you never sent
The short answer
Your wallet was not hacked. Nobody used your keys. Anyone can write a zero-value transfer into your history, because moving 0 tokens out of your wallet needs no permission from you.
It is bait. The address it points to is a lookalike of someone you really paid. The attack pays off the day you copy that address from your history and send real money to it.
Eight seconds after a real payment
13 May 2026, Arbitrum. At 10:55:03 the sample wallet on this site paid 50 USDC to 0x82d1b299…db67. At 10:55:11 its history showed 0 USDC leaving the wallet for 0x82d1439e…db67. Same first characters, same last four. The wallet did not send it.
On Arbiscan: the real payment and the zero-value entry.
In the next two minutes three more entries arrived from lookalikes of the same recipient: 0.00005 USDC from 0x82d1439e…db67, then 0 ETH and 0.00005 USDC from 0x82d1cdb1…db67. That USDC is real, a fraction of a cent, sent so the lookalike also shows up as someone who paid you. Because the token is genuine, WalletHistory does not flag these entries yet.
Why it needs no signature from you
A token contract keeps a list of allowances: how much each address may move out of yours. The function transferFrom(from, to, amount) checks that list before it moves anything. USDC and USDT accept the call when the amount is not larger than the allowance. For an amount of 0 that is always true, even if you never approved anyone.
So the attacker calls the real USDC contract and asks it to move 0 USDC from your wallet to the lookalike. The contract agrees and records a Transfer event from your address, exactly as it does for a real payment. Explorers and wallet apps read that event and list it as an outgoing USDC transfer of yours.
The entry on 13 May was sent by 0x2ac68b…, not by the wallet, and the same transaction did this to 7 wallets at once. On 1 August 2026 a single transaction did it to 64: 39 in USDT, 24 in USDC and one in another token, each from a different wallet to its own lookalike. Not a single token left any of them.
Seventeen in eight months
The sample wallet has 17 of these entries between 15 January and 1 August 2026, aimed at six different people it pays. Some follow the payment within seconds, others hours later.
| Date | Chain | The real payment | The zero-value entry | Delay |
|---|---|---|---|---|
| 20 January 2026 | Ethereum | 99.73 USDC to 0x82d1b299…db67 | 0 USDC to 0x82d1cdb1…db67 | 2m 24s |
| 25 January 2026 | Ethereum | 800 USDC to 0x48da2cb9…2ae7 | 0 USDC to 0x48dab60e…2ae7 | 6m 36s |
| 13 May 2026 | Arbitrum | 50 USDC to 0x82d1b299…db67 | 0 USDC to 0x82d1439e…db67 | 8s |
| 1 June 2026 | Ethereum | 50 USDT to 0x82d1b299…db67 | 0 USDT to 0x82d15ef5…db67 | 4m 12s |
| 1 August 2026 | Ethereum | 650 USDT to 0x664676bf…e8c8 | 0 USDT to 0x6646467d…e8c8 | 3m 24s |
The bait does not expire. One lookalike, 0x82d1cdb1…db67, turns up five times between 15 January and 11 April, on Ethereum and Arbitrum. Another, 0x48da9b25…2ae7, was planted three times: once on 29 May, the day of a real 931 USDC payment, and again on 27 July and 1 August, two months later.
What the attacker is waiting for
The 13 May pair in full:
0x82d1b299ec11fe3f02d15a3ce6b35733ff45db67 the real recipient
0x82d1439ee00fda8728a2969f3e9446f3b4c0db67 the lookalike
Generating an address that shares the first and last characters with another is cheap computing work. The middle is where they differ. The next time the owner pays the same person and copies the last recipient from the history, the line they pick may belong to the attacker. Real money sent there is gone.
What to do
- Leave the entry alone. There is nothing to revoke and nothing to claim. Your keys and your allowances did not change.
- Never copy a recipient from your history. Use your address book, or ask the recipient for the address again.
- Before you send, compare characters from the middle of the address, not only the start and the end.
- Pay a new recipient a small test amount first, and check where it arrived.
A transfer already sent to a lookalike cannot be reversed on-chain. If the money reached an exchange, that exchange is the only party that can freeze it. Contact it with the transaction hash.
The same attack in other forms
- The fake copy of your last payment: the same amount "sent" again, in a token that only looks like USDT or USDC.
- Fake USDC or USDT in your wallet: tokens that arrive with a link in their name.
Check your own address
Paste an address on the front page. WalletHistory reads the last 500 transactions on ten EVM chains and marks every zero-value entry with the lookalike and the real address it imitates side by side. There is nothing to connect and nothing to sign.
These rows are hidden by default. Switch off Hide spam in the Transactions tab to see each one in place. This is the wallet in this article.
The same trick is common on Tron, where most USDT moves. This page covers Ethereum and the other EVM chains. The tool does not read Tron.