Don't ever copy addresses directly from your recent transactions when transferring funds...

Today’s painful lesson: a whale/institution was phished and lost 50 million USDT...
1⃣10 hours ago, he withdrew 50 million USDT from Binance, then tested a transfer of 50 USDT to the address he planned to send to.
2⃣Here’s the key point: the phishing attacker generated an address with the first and last 3 characters the same and sent him 0.005 USDT. When he made the actual transfer, he probably copied the address from his recent transaction record, and then all 50 million USDT was transferred to the attacker’s similar address...
3⃣The attacker quickly exchanged the 50 million USDT for DAI (to prevent freezing), then bought all 16,624 ETH. These ETH were then completely washed through Tornado (Cash).
Phishing whale/institution address: 0xcB80784ef74C98A89b6Ab8D96ebE890859600819
Phishing attacker address: 0xBaFF2F13638C04B10F8119760B2D2aE86b08f8b5
Blood and tears lesson:
#USDT
1⃣ Never copy addresses directly from recent transaction records when transferring funds; address poisoning attacks are extremely common. Just one transfer on your chain, and the attacker will generate N similar addresses to perform dust poisoning. Copying addresses from recent transactions makes you very vulnerable.
2⃣ When confirming an address, never just look at the first and last few characters. Generating an address with the same first and last few characters is ridiculously easy.