TL;DR
An Ethereum wallet dormant since the network’s 2015 launch moved 2,154.94 ETH worth about $4.6 million after first sending a small test transaction.
Within three minutes, attackers launched an address-poisoning attempt using lookalike addresses and repeated dust transfers designed to contaminate the wallet’s transaction history.
The owner avoided the trap, verified the destination with another transfer and ultimately sent the full balance to the intended address without losing funds.
An Ethereum wallet dating to the network’s 2015 launch moved about $4.6 million in ETH after more than a decade without an outgoing transaction, while avoiding an address-poisoning attempt that appeared within minutes. The wallet address first received ether in Ethereum’s genesis block and later accumulated another 755 ETH in March 2016. The owner successfully sent the funds to the intended destination despite lookalike addresses being inserted into the wallet’s transaction history. The episode highlights why control of private keys alone does not eliminate transaction-level security risks.
Address-Poisoning Bots React Within Three Minutes
The wallet’s first outgoing move came at 22:04 UTC, when it sent a 0.05 ETH test transaction worth roughly $106 to an address beginning 0x1321beb8 and ending 1A44. Within three minutes, tiny transfers began arriving from addresses designed to resemble that recipient, including addresses beginning 0x13211f and 0x1321FB while sharing the same final characters. The attack relied on visual similarity rather than compromising the wallet or stealing its keys. One of the malicious addresses sent 43 dust transfers, echoing earlier Etherscan warnings about address-poisoning activity .
Address poisoning attempts to manipulate transaction history so a user later copies a fraudulent recent address instead of the legitimate recipient. The risk is amplified because wallet interfaces often abbreviate long hexadecimal addresses, making carefully generated lookalikes harder to distinguish at a glance. This attack arrived precisely after a small test payment, when a larger follow-up transfer could reasonably be expected. Dormant wallets can attract particular attention when they suddenly reactivate, as seen in other long-inactive Ethereum addresses returning onchain .
The owner added another verification step before moving the full balance. At 22:20 UTC, the destination wallet sent 0.01 ETH onward, with nearly all of it returning three minutes later. Then, at 22:42 UTC, 38 minutes after the original test, the dormant wallet transferred 2,154.94 ETH, worth roughly $4.6 million, to the correct 0x1321beb8 address. The successful transfer shows that the poisoning attempt failed despite being deployed almost immediately after the wallet became active. No funds were sent to lookalike addresses, and the intended destination ultimately received the full transfer without incident. The case reinforces the operational importance of verifying full addresses rather than relying on abbreviated wallet history, particularly when moving large balances from dormant Ethereum wallets .
