Mentioned in This Article
1. A dormant wallet wakes up and is targeted at once
A wallet that received its first ether when Ethereum launched in July 2015 made its first-ever outgoing transfer on Monday, November 9, and was targeted by address-poisoning scammers within three minutes. The owner nonetheless sent 2,154.94 ETH, worth about $4.6 million, to the intended destination 38 minutes after an initial test payment.
The episode shows how quickly automated attackers react when an old, large wallet shows signs of life. Nothing about the owner's behavior was careless: a small test payment is a standard precaution before moving a large balance. The scammers simply turned that precaution into their opening.
On-chain records show the whole sequence in a single evening, which makes the case a useful, concrete illustration of a scam that usually plays out unseen and is only noticed after money is gone.
For readers unfamiliar with the term, a genesis-era wallet is simply one that was funded when the network first started, and its owner has held the same keys ever since. Moving such a balance is a rare event, and every step of it deserves the same care the owner showed here, from the first test to the final confirmation.
2. What is the history of the wallet?
The wallet, whose address begins 0x7dDd and ends 59Bc, received ether in Ethereum's genesis block, the very first block of the network, in July 2015. It took in a further 755 ETH in March 2016. After that it sat untouched, with no outgoing transaction of any kind, for roughly a decade.
Wallets of this age are often the subject of speculation whenever they move, because they date from the period before Ethereum had an established market and when early participants acquired coins at a tiny fraction of today's prices. A balance that old is also easy for anyone watching the chain to identify, since the wallet's entire history is public and fixed.
On Monday at 22:04 UTC, the wallet sent a 0.05 ETH test payment, worth about $106, to a new address. The transfer was flagged publicly by the Whale Alert tracking service, which draws attention to unusual movements of large or long-idle holdings. That visibility mattered, because anyone monitoring the chain could see the same signal.
The case also underlines a basic property of public blockchains: every transaction, including the quiet history of an idle wallet, can be inspected by anyone. That transparency is a strength for auditing, but it lets automated tools react to an owner's actions in real time, long before the owner has finished the job they started.
3. How did the scammers respond so fast?
Within three minutes of the test payment, the old wallet began receiving tiny transfers from two lookalike addresses, both ending in 1A44. Etherscan, the widely used blockchain explorer, labels the funding accounts as fake or phishing addresses. The busier of the two sent 43 separate dust payments, meaning deposits of trivially small value.
The speed points to automation rather than manual effort. Software can watch the network for large dormant wallets, treat a first outgoing test transfer as evidence that a bigger payment is coming, and generate an address crafted to resemble the real destination. Funding the lookalike accounts and sending the dust took only minutes.
The test payment was the trigger the scammers were waiting for, because it indicated that the owner was about to send the bulk of the funds to the same new address.
For an attacker, the economics are favorable. Generating many candidate addresses until one resembles the target's destination takes computing effort but no special access, and the dust transfers cost only a small network fee. Nothing in the process requires breaking into the wallet or learning any private key; the entire attack relies on the owner making a mistake while copying an address.
4. How does address poisoning work?
Address poisoning is a scam that exploits the way wallet software displays information. Many wallet apps and explorers show only the first and last few characters of a long address. An attacker generates a fresh address whose beginning and ending characters match those of the address a victim has just used, then sends the victim a tiny transaction from it so that the fake address appears in the victim's transaction history.
The trap springs if the owner later copies an address from that history, such as a recent recipient, instead of the one originally intended. Because only the visible characters are compared, the fake can pass for the real thing, and the funds go to the scammer. Blockchain transfers are irreversible, so there is normally no way to recover money sent this way.
The tactic works best right after a test payment, which is the moment an owner is about to send the main amount and may reach for a recent entry in the history. In this case the two lookalike addresses were seeded into the old wallet's history within minutes, precisely in that window.
A related risk is that some wallet interfaces hide the middle of an address entirely and highlight recent contacts for convenience. Features designed to save time can therefore become the exact surface that an attacker targets, which is why careful users often prefer to verify an address through an independent channel before approving a large transfer.
5. How the owner avoided the trap
The owner did not fall for it and added another check. At 22:20 UTC, the new wallet sent 0.01 ETH onward, and nearly all of it came back about three minutes later, a sign that the owner was confirming control of the receiving address before committing the larger sum.
At 22:42 UTC, 38 minutes after the first test, the old wallet sent 2,154.94 ETH, roughly $4.6 million, to the correct address. That address now holds about 2,155 ETH, so the transfer arrived intact.
The sequence reflects careful practice: a test transfer, a return transfer, and then the main payment, with the destination confirmed independently rather than copied from a list of recent counterparties. Entering or verifying the full address by another route, rather than trusting a shortened display, is the safeguard security specialists most often recommend against this scam.
The measured pace of the owner's steps, spread across about 38 minutes, also shows that caution does not require special tools. It required patience, an extra small transfer and a refusal to take shortcuts with a balance of this size.
6. Why address poisoning keeps growing on Ethereum
Address poisoning has become a high-volume activity on Ethereum. In January, Citi warned that poisoning spam was inflating the network's record transaction counts, with much of the new activity consisting of transfers worth less than $1, similar in size to the dust sent to the 2015 wallet.
The economics explain the growth. Sending a tiny transfer costs very little, attackers can automate the creation of lookalike addresses, and a single success can pay for a very large number of failed attempts. Targets with large balances, such as long-dormant wallets, offer the biggest potential reward.
That also means headline activity figures can overstate real usage. When a significant share of transactions is dust sent to seed fake addresses, raw counts say less about genuine economic activity than they appear to.
7. What should wallet holders take from this?
The case offers several practical lessons. Do not copy a destination from recent transaction history, since that list can contain addresses planted by attackers. Compare the complete address, not only the first and last characters, or use an address book or saved entry that was verified in advance.
Test payments remain sensible, but they should be treated as a moment of heightened risk rather than only a safety step, because bots may be watching for them. A second confirmation, such as a small return transfer from the new address, adds assurance that the owner controls the destination.
For anyone holding an old wallet that has not moved in years, the same logic applies: the first outgoing transaction is public and can attract immediate attention. Preparing the destination in advance and verifying it fully before sending reduces the window in which a lookalike address can do harm.
In this instance, the outcome was a success for the owner. About $4.6 million in ether moved from a wallet that dates back to Ethereum's first block to its intended destination, while the scammers were left with nothing but a pile of dust transactions and two flagged addresses.
8. What does a test transfer actually protect against?
A test transfer protects mainly against typing errors and mistaken networks. By sending a small amount first, an owner confirms that the destination address is valid, that it can receive funds and that the funds arrive where expected. If something is wrong, the loss is limited to a negligible sum instead of the entire balance.
What a test transfer cannot do by itself is guard against a poisoned history. If the owner later chooses the wrong entry from a list of recent recipients, the first small payment will have succeeded while the main payment goes astray. That is why the order of operations matters: the main transfer should be sent to an address verified in full, not to whichever entry looks familiar.
Hardware wallets and software that show the full address on a separate confirmation screen make the check easier, since the owner can compare every character instead of the shortened version. Security specialists generally suggest treating any unsolicited incoming transaction, especially one worth almost nothing, as a warning sign rather than a harmless curiosity and never as a source of addresses to reuse.