Critical issue: Mycelium replaced payment address with contract address (funds lost)

[Pricekiller]

I am reporting a critical issue with Mycelium that resulted in the loss of my funds.
This appears to be a wallet malfunction involving QR code parsing or address substitution.

What happened

When I scanned a merchant’s QR code to make a USDT (ERC-20) payment, Mycelium displayed a completely different address than the one shown on the merchant’s checkout page.
Specifically, the wallet replaced the valid payment address with the USDT contract address, and the transaction was sent there.

The merchant confirmed that the QR code contained the correct recipient address. This indicates that Mycelium incorrectly interpreted the QR data or auto-filled a wrong address internally.

As a result, my payment never reached the intended recipient, and the funds are now stuck in the contract.

This was not user error — it was caused entirely by the wallet displaying a different address than the QR code actually contained.

Important details

Transaction hash:
0xfd536615fb9ff4fcf834e154a18c9baae517867f5b42813bf2507251af48e1d8

Address Mycelium used:
0xdAC17F958D2ee523a2206206994597C13D831ec7 (USDT contract)

Correct payment address (from merchant):
0x1E61f53331476295dECC0F023A89041a8b9DE6Bb

Date and time:
20.11.2025 – 19:44 (GMT+02:00)

The QR code and screenshots showing the incorrect address displayed by Mycelium are attached.

What I kindly request

Please investigate why Mycelium replaced the correct payment address with a contract address.
This is a serious issue that could affect other users as well.

Please let me know if you are able to assist with recovering the lost funds or providing compensation.
Since the issue was caused by the wallet itself displaying an incorrect destination address, I would greatly appreciate your help in resolving the financial loss.

Please clarify how this can be prevented in the future, as this situation makes it unsafe to rely on QR payments in the current version of the wallet.

I have been using Mycelium for a long time and have always trusted it, which is why this issue is especially concerning.
I would be grateful for your assistance and a review of this incident.

Thank you for your time and support.
I look forward to your reply. If needed, you can reach me at kunkovd@yahoo.com

Best regards,
Dmitrij Kunkov

[kurtnebiev-elvis4]

Thank you for reaching out and providing detailed information about this incident. We sincerely apologize for the inconvenience and stress this situation has caused.
Regarding the issue
We have identified the problem with EIP-681 QR code parsing for ERC-20 token transfers. Our development team is actively working on a fix to prevent this from happening in the future.
Recovering your funds
The good news is that your USDT tokens can be recovered. Since the funds were sent to the USDT contract address, Tether has the ability to retrieve them.
Please contact Tether Support directly:

Email: support@tether.to
Website: https://tether.to/en/contact-us/

In your request, include:

Transaction hash, Amount, Your wallet address (sender) and
Brief explanation that funds were mistakenly sent to the contract address

Tether regularly processes such recovery requests.

Next steps on our side
We are preparing a patch to fix the QR code parsing logic. We will notify users once the update is available.
General recommendation
We kindly recommend always double-checking the recipient address on the confirmation screen before approving any transaction — especially for large amounts. This extra step can help prevent losses in case of any unexpected issues.
Again, we apologize for this experience and appreciate your patience.

Best regards,
Mycelium Support Team