An Ethereum wallet that had recorded no outgoing transactions for more than a decade moved approximately $4.6 million on Monday, despite an address-poisoning attempt that began minutes after its owner sent a small test payment. The attempted deception exposed the copy-paste risks that accompany routine transfer verification.

CoinDesk identified the wallet as 0x7dDd…59Bc, first funded in Ethereum's July 2015 genesis block. The address can be viewed on Etherscan. A further 755 ETH arrived in March 2016, after which the wallet remained without outgoing transfers for more than ten years.

Lookalike Transfers Within Three Minutes

At 22:04 UTC on November 9, the wallet sent 0.05 ETH to a new recipient, an address that began 0x1321beb8 and ended with 1A44, according to the transaction report. Within three minutes, tiny transfers appeared from two addresses resembling that destination. Both ended in 1A44, but their opening characters differed. CoinDesk reported that Etherscan labeled the accounts funding them "Fake_Phishing." One of the lookalikes reportedly sent 43 dust payments, placing misleading addresses in the wallet's recent activity and creating a trap for later copy-paste mistakes.

How Address Poisoning Works

The scheme does not require attackers to breach a blockchain or steal private keys. Instead, it relies on a user copying a counterfeit address from transaction history. Wallet interfaces frequently abbreviate addresses, which can conceal differences between genuine and forged destinations.

An October-reviewed investigation by blockchain analytics company Bitquery, documented in its address-poisoning research, detailed the broader threat. Researchers traced 1,635 victims and $76.1 million in measured losses over twelve months. The dataset covered Ethereum mainnet through July 31, 2026, rather than all blockchains, and counted nearly 67 million poisoning attempts targeting approximately eight million wallets. Researchers characterized the measured loss total as a minimum rather than a comprehensive estimate.

The danger extends beyond failed attempts. One victim in December 2025 sent a $50 test payment and subsequently lost nearly $50 million in USDT. Bitquery found that a lookalike address entered the victim's history after the test, demonstrating that a successful test alone cannot authenticate a later copied address. The attempt on the long-dormant wallet mirrored that documented sequence — a test payment first, then lookalike addresses surfacing in its recent history within minutes.

Larger Transfer Avoids Poisoned Addresses

At 22:20 UTC, the new recipient forwarded 0.01 ETH, with most returning shortly afterward. At 22:42 UTC, approximately 38 minutes after the initial test, the original wallet transferred 2,154.94 ETH. The larger payment reached the original test recipient, not either of the reported lookalike addresses, establishing that the visible attempt did not divert the transfer.

On-chain records cannot, however, reveal how the sender selected or verified the destination, nor can they establish the wallet owner's identity or the reason for moving the funds.

CoinCentral previously covered Citi's warning that address-poisoning spam can distort Ethereum transaction activity, a concern underscored by the attempt volume in Bitquery's data. Bitquery recommends copying destinations from trusted sources rather than unverified transaction histories, and its findings identify dust filtering as a potential safeguard for wallet providers — a feature that would screen out the tiny transfers used to seed histories with lookalike addresses. Whether wallet providers adopt such filtering is a development worth watching, and any further movement from the genesis-era address would be visible in public on-chain records.