A 0 USDT transfer you never made just showed up in your history

The line in your history reads 0 USDT. Or 0.001. Or it’s a token called “USDT” whose logo won’t load. The other address begins and ends with the same characters as the one you paid last week.

Nothing left your wallet. The point of that line is what happens later, when you scroll back, tap “the address from last time” and copy this one instead. Binance’s security team calls the technique address poisoning, or address spoofing.

Why did I receive a 0 USDT transfer?

Every on-chain history is public. Someone picks out addresses you interact with, generates new ones that share the first and last characters, and sends you a zero-value, dust or look-alike-token transfer from one of them so it sits in your list. Binance’s post The Binance Antidote: Protecting Users From Address Poisoning Attacks describes small amounts of crypto, NFTs or worthless tokens sent from a wallet that closely mimics a familiar one; copy an address from recent history and the funds go to the scammer.

You weren’t singled out for any particular reason. Etherscan explains that automated systems generate the look-alike addresses and then send the poison transfers to targets. Binance’s figures, at the time of its post: more than 13.4 million spoofed addresses flagged on BNB Smart Chain and 1.68 million on Ethereum. Having an on-chain history is enough to be picked.

Is my wallet hacked? Check the balance first

Look at your USDT balance and your gas-token balance (TRX, ETH or BNB). Do they match what you expect?

• Balances unchanged, one extra line for zero or dust: that’s poisoning. Trezor’s support page What are address poisoning attacks and how to avoid them says there is no need to worry about the safety of your assets or leaked private keys in this case, and that nobody can stop others from sending transactions to an address.
• Funds actually gone, and you didn’t send them: not poisoning. Something has control of the wallet or an approval you signed. Stop depositing to it, keep the records, and read how to spot a recovery scam before anyone offers to “get it back”.
• You sent it, the recipient says nothing arrived: open that outgoing transaction and compare the destination character by character. If it doesn’t match the address you were given but does match the ends of a stranger’s entry, the payment most likely went to the poisoned address. Etherscan’s phrasing: there are no undo buttons in crypto.

Why it shows 0 USDT sent from my own address

Sometimes the entry is worse-looking: 0 USDT sent from you to the look-alike. Etherscan’s Information Center article Address Poisoning Attacks covers this. For legitimate tokens such as USDT and USDC, the attacker calls transferFrom with an amount of zero. Every address starts with a zero approval for everyone, a zero-token transfer doesn’t exceed it, and so the chain records a Transfer event anyway.

No private key, no approval from you. Among Etherscan’s warnings is to be careful when a transaction originated from an address other than the token’s sender. Open the transaction details and check the From at the top, the address that actually submitted it. If that isn’t you, someone else wrote a zero into your history.

You may also notice the entry in your wallet but not on Etherscan. That’s expected: Etherscan hides zero-value transfers by default, and you can switch that off in its site settings if you want to see them.

Should I delete it or send it back?

You can’t delete an on-chain record, and there’s no need. Make it harmless instead:

• Don’t send the dust back, and don’t open any link tucked into the token name or the transfer.
• For a “USDT” whose logo doesn’t load or whose contract isn’t verified, Etherscan advises not interacting with it and adding it to the Token Ignore List. If your wallet has a hide-token or hide-small-transactions option, turn it on.
• Label the handful of addresses you really use, so a named entry stands out from an unnamed copy.

Trezor puts it simply: if you don’t know why you received a transaction, ignore it. The poisoned address is still safe to keep using.

Where to copy a USDT address from next time

The attack only works if you copy from history. Trezor’s advice is to avoid copying addresses from transaction history, whether in your wallet or on a block explorer, and that includes sending to your own other address.

Take the address from the source instead: the recipient’s own deposit page (ask them to copy it fresh if it’s an exchange account), an address book entry you saved and labelled earlier, or your exchange’s withdrawal whitelist. What a whitelist and a test transfer each protect against is covered in withdrawal whitelist or small test.

After pasting, check the whole address, not just the start or the end. The same post gives the reason: some malware swaps the address on your clipboard. Split the pasted string into chunks and compare each against the source. The middle chunks matter most.

A small test first is advice both Binance and Trezor give, with Trezor noting it doubles what you pay in network fees. A successful test proves that one address was right at that moment. For the main transfer, go back to the original source and copy again rather than tapping the test in your history; by then a fresh look-alike may have landed right next to it.

Withdrawing from an exchange to a wallet

Poisoning targets on-chain address histories. If you move funds between an exchange and a wallet, the risk sits in where each address was copied from.

Wallet to exchange: copy from the exchange’s deposit page every time and match the network (see your first USDT transfer). Exchange to wallet: copy from the wallet’s Receive screen, not from its history and not from your previous withdrawal on the exchange. Whitelisting the addresses you use regularly takes that step out of your hands.

Binance says the spoofed addresses it flags are recorded in the database of its security partner HashDit, which Trust Wallet uses to warn people about to send to one. That helps, but the post doesn’t claim coverage of every chain or wallet; no warning doesn’t mean the address is right.

Sources behind this guide, all opened on 20 October 2026: Binance blog “The Binance Antidote: Protecting Users From Address Poisoning Attacks” (2024-05-16); Etherscan Information Center “Address Poisoning Attacks” (published 2024-01-15) and “Address Poisoning Attacks Are Rising on Ethereum” (published 2026-03-09); Trezor support “What are address poisoning attacks and how to avoid them” (no date shown).