Why not copy the deposit address from the exchange's app or website? That should be a much better and secure practice, given that exchanges sometimes change deposit addresses due to various reasons.
Exactly. And I still don't understand how the alleged thief would have known that someone would do this. Is this a common practice?
The thief's address matched three bytes of the victim's address (one at the beginning of the address and two at the end). I would have thought that if this was done on purpose they'd try to generate an address that matches more bytes at the beginning because that's what the explorer shows. But I checked a few other 0 token transfers from the same TX and there were similar 3-4 byte matches to other addresses that previously received large amounts, so it can't be a coincidence.
Seems like a very low effort low probability "attack" if you can even call it that. And someone hit a jackpot.