The attacker sent a zero-value transfer from an address that looked identical to the victim's contact address.

Address poisoning attacks exploit the common habit of copying recent transaction history rather than verifying full addresses.