- User sends crypto to some address, say 0x1234...abcd
- An attacker identifies a pattern of the user sending crypto to that address
- Attacker brute-forces a similar looking wallet address, say 0x1235...bbcd - this is the phishing address that the attacker controls
- Attacker sends a fake transaction of crypto from the user's address to the phishing address
- User, wanting to send another txn, sees that wallet in their recent history and uses the phishing address
This is a common scam in crypto and it has been relatively unsuccessful up until now. Someone sending $20M worth of USDT had extremely bad security practices. Typically you would avoid this by having a known, whitelisted addresses you send to and a complex process to add new addresses to the whitelist to ensure you don't fat-finger an address.