Nov 10, 2026, 2:01 a.m. EST
2 min read
Summary
- An Ethereum address originating from the network’s 2015 introduction executed its initial outgoing transfer on Monday, attracting fraudulent attempts within three minutes of a minor test transaction.
- The fraudsters employed address poisoning, dispatching micro-transactions from mimic addresses to trick the holder into copying a malicious address from the wallet’s activity log.
- The owner sidestepped the trap and successfully transferred approximately $4.6 million worth of ether to the intended destination 38 minutes after the initial test.
An Ethereum wallet dating back to the network’s genesis block in 2015 disbursed funds for the first instance late Monday, immediately drawing unwanted attention.
The account, 0x7dDd57165c87A2707f025DCFC2508c09834759Bc, received its first ether during the establishment of Ethereum’s genesis block in July 2015, and took in another 755 ETH in March 2016. It never transferred any assets outward until Monday, when it executed a 0.05 ETH test transfer valued at roughly $106 at 22:04 UTC to a fresh address beginning with 0x1321beb8 and concluding with 1A44. Cryptocurrency monitoring service Whale Alert highlighted the transaction.
That test transfer was precisely what the malicious actors were anticipating.
Within the span of three minutes, the vintage wallet began receiving a succession of micro-transfers of ether. These originated from two addresses engineered to closely resemble the exact one the owner had just paid, with one starting with 0x13211f and the other with 0x1321FB, and both terminating in 1A44. Etherscan records indicate both were financed by accounts it labels as “Fake_Phishing,” and the more active one dispatched 43 of these dust transactions.
How the scam works
This tactic is known as address poisoning. Wallet applications typically display only the initial and final few characters of an address, enabling a scammer to create a lookalike and deposit dust into the victim’s transfer history.
If the holder subsequently copies the recent recipient from that history to dispatch the genuine funds, the assets route to the attacker instead. This method operates most effectively on individuals who have just completed a test transfer and are on the verge of sending the remaining balance, matching the exact situation of this wallet owner.
The mimic addresses received funding within minutes following the test payment, according to data. Automated bots monitor the blockchain continuously for large, long-inactive wallets, and a test transaction from one can serve as an indicator that a substantially larger transfer is likely imminent.
Nevertheless, the owner avoided the deception in this scenario and implemented an additional security measure along the way. At 22:20 UTC, the new wallet sent 0.01 ETH forward, and nearly the entire amount returned three minutes later.
Subsequently, at 22:42 UTC, 38 minutes after the initial trial, the legacy wallet disbursed 2,154.94 ETH, valued at approximately $4.6 million, to the accurate 0x1321beb8 address, which currently holds roughly 2,155 ETH.
Address poisoning has evolved into a high-volume enterprise across Ethereum. Back in January, Citi cautioned that poisoning spam was driving up the network’s record transaction volumes, with a significant portion of the fresh activity consisting of transfers valued under $1—comparable to the volume these fraudsters sprayed at the 2015 wallet.
Originally published at https://www.coindesk.com/tech/2026/11/10/an-11-year-old-ethereum-wallet-moved-usd4-6-million-and-dodged-a-scam-set-up-in-minutes.
