Over $500 million worth of tokens were sent to the wrong address

0xUsamaro
StableUnit
Published in
4 min readFeb 13, 2023

There are multiple ways to lose your crypto. It can be through scams, hacks, or simply due to simple human mistakes that can lead to irrecoverable losses.

One of these mistakes can happen when transferring crypto and this happened with hundreds of millions of dollars worth of cryptocurrency. It can be due to copying or selecting the wrong address, sending tokens to token contracts instead of the desired recipient, sending tokens to a multisig wallet that wasn’t deployed, etc.

This blog post will cover the most publicized cases of lost tokens due to transfer mistakes. The biggest instance of tokens sent to the wrong address in the past months was Crypto.com, a well-known cryptocurrency exchange that sent $400 million worth of ETH.

Recoverable losses

The Verge article about Crypto.com’s transfer mistake

In this instance, Crypto.com sent 320,000 ETH to a Gate.io wallet (another cryptocurrency exchange). Luck was on their side this time as they were able to get the full amount back. Gate.io labeled the mistake as an “an operation error.” An operation error that could’ve cost the exchange approximately 10% of their customers’ funds based on the CEX’s transparency data from Defillama

Crypto.com CEX transparency data from Defillama

Ultimately, they were able to retrieve the funds without paying anything significant for the mistake they did. The next company had to pay a whitehat bounty to recoup the funds.

Cryptoslate article about Optimism Foundation’s transfer mistake

Optimism Foundation sent 20 million OP tokens (valued today at $45 million) to a Wintermute multisig wallet that wasn’t deployed. An attacker was able to deploy that multisig wallet before Wintermute and took possession of the 20 million tokens.

In the end, the attacker settled for 2 million OP tokens (valued today at approximately 4.5$ million) as a whitehat bounty. This shows how expensive this type of mistake can be. Yet, they were still lucky to recover the majority of the tokens.

Irrecoverable losses

Coindesk article about the JUNO whale that lost $36 million worth of the Juno token.

Luck turned around and became a misfortune. A whale sent $36 million worth of the Juno token to the wrong address due to a bad copy-paste. These tokens are lost forever and there is nothing this whale can do.

This is only one example among many who, despite their knowledge of blockchains, lost tokens forever because of simple transfer mistakes.

Another publicized case would be the whale that sent 28,050 AAVE tokens to the smart contract address.

Aave token contract page

Users also sent other tokens such as USDT, LEND, StAAVE, Uniswap, etc. These tokens are also lost forever. While there is no way to recover them, there is a way to prevent such problems from happening.

When you normally transfer tokens, Metamask, or any other wallet you might use calls the “transfer” function of the token contract supported by the ERC-20 standard. However, the erc-20 standard also supports two other functions: “approve” and “transferFrom” which can make your token transfers foolproof.

Instead of transferring the tokens, you can allow the recipient to withdraw them from your wallet by approving a specific amount for them. The recipient will just need to call the “transferFrom” function from their wallet. If there is any mistake, the sender can simply revoke the approval.

This can be done on Etherscan, BSCscan, Fantomscan, Snowtrace, or any EVM blockchain explorer.

We decided to call this pattern SafeTransfer, below is a guide on how to do it manually.

How to SafeTransfer manually

SafeTransfer can also be done in a much easier way through safetransfer.cash which is also presented in the video below.

How to SafeTransfer automatically

Both ways work the same and follow the exact same steps. Feel free to chose the one you are the most comfortable with but start making your transfers stress-free now. Mistakes can’t be recovered but they can be be prevented.

--

--