An 11-year-old Ethereum wallet moved $4.6 million and dodged a scam set up in minutes

Tech An 11-year-old Ethereum wallet moved $4.6 million and dodged a scam set up in minutes Bots spotted a wallet from Ethereum’s 2015 launch the moment it stirred and planted lookalike addresses in its history, but the owner sent the money to the right place anyway. By Shaurya Malwa Nov 10, 2026, 2:01 a.m. EST 2 min read Make preferred on Share Share this article Copy link X icon X (Twitter) LinkedIn Facebook Email Make preferred on Enlarge image Summary Show An Ethereum wallet dating to the network’s 2015 launch made its first outgoing transfer Monday, drawing scam attempts within three minutes of a small test payment. The scammers used “address poisoning,” sending tiny payments from lookalike addresses to trick the owner into copying a fraudulent address from the wallet’s transaction history. The owner avoided the trap and transferred about $4.6 million in ether to the intended address 38 minutes after the initial test. An Ethereum wallet dating to the network’s 2015 launch sent money for the first time late Monday, and within minutes it had company it didn’t ask for. The address, 0x7dDd57165c87A2707f025DCFC2508c09834759Bc , got its first ether in Ethereum’s genesis block, the very first block of the chain, in July 2015, and took in another 755 ETH in March 2016. It never sent anything out until Monday, when it made a 0.05 ETH test payment worth about $106 at 22:04 UTC to a new address starting 0x1321beb8 and ending 1A44. Blockchain tracker Whale Alert flagged the move. That test is what the scammers were waiting for. Within three minutes the old wallet started receiving a stream of transfers of tiny amounts of ether. They came from two addresses built to look almost exactly like the one the owner had just paid, one starting 0x13211f and the other 0x1321FB, and both ending in 1A44. Etherscan shows both were funded by accounts it tags as “ Fake_Phishing ,” and the busier one sent 43 of these dust payments. How the scam works The trick is called address poisoning. Wallet apps usually show only the first and last few characters of an address, so a scammer makes a lookalike and drops dust into the target’s transaction history. If the owner then copies the “recent recipient” from that history to send the real money, the funds go to the scammer. It works best on someone who has just sent a test payment and is about to send everything else, which is exactly where this owner was. The lookalike addresses were funded within minutes of the test payment, data shows. Bots watch the chain around the clock for large, long-dormant wallets, and a test transfer from one can be taken as a signal of a bigger payment probably coming. The owner didn’t fall for it in this instance, however, and took a second precaution along the way. At 22:20 UTC the new wallet sent 0.01 ETH onward , and nearly all of it came back three minutes later. Then, at 22:42 UTC, 38 minutes after the first test, the old wallet sent 2,154.94 ETH, roughly $4.6 million, to the correct 0x1321beb8 address, which now holds about 2,155 ETH. Address poisoning has turned into a volume business on Ethereum. In January, Citi warned that poisoning spam was inflating the network’s record transaction counts with much of the new activity being transfers worth less than $1 — about the same amount these scammers sprayed at the 2015 wallet. Read More: Citi sounds the alarm on address poisoning scams flooding the Ethereum network Latest Crypto News 1 Bitcoin miner MARA sold 13,597 BTC for $1.1 billion in six weeks, plans to sell more 2 hours ago 2 XRP Ledger maps out quantum-proof accounts, with no extra fees for users 3 hours ago 3 Bitcoin faces U.S. CPI test as analysts warn inflation relief may not be enough 4 hours ago 4 Securitize pushes into $6 trillion asset-backed finance market with River One acquisition 9 hours ago 5 Robinhood backs tokenization of its stock on OKX–ICE platform even as most companies opt out 12 hours ago 6 A Bitcoin block just neared a 2015 transaction record, but paid only $180 in fees 15 hours ago 7 Google’s AI chip push adds more pressure on Nvidia 16 hours ago 8 North Korean hackers are creating memecoins to wash loot from $6.3 billion Binance hack 17 hours ago 9 NYSE picks Avalanche to settle tokenized stocks amid Wall Street's blockchain race 18 hours ago 10 Solana set for its first tokenized stock venue under SEC framework, listing Galaxy 19 hours ago Latest Research Beyond the Risk-Free Rate: Diversified Real World Yield in Productive Stablecoins Beyond the Risk-Free Rate: Diversified Real World Yield in Productive Stablecoins Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years. By CoinDesk Research Sep 24, 2026 Commissioned by RealFi Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years. Why it matters : Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years. View Full Report More From Tech XRP Ledger maps out quantum-proof accounts, with no extra fees for users A Bitcoin block just neared a 2015 transaction record, but paid only $180 in fees Zcash developers want 20-second blocks just days after major speed upgrade