An Ethereum wallet created in the network's 2015 genesis block sent funds for the first time in 11 years, and within just under three minutes, scammers began spraying dust at the address in an apparent address-poisoning attempt.

The wallet's owner ultimately moved 2,154.94 ETH, worth roughly $4.6 million at the time, to the correct destination, avoiding the lookalike addresses planted in the transaction history.

Two lookalike addresses ending in 1A44 imitated the recipient

The address first received ether in Ethereum's genesis block in July 2015 and collected another 755 ETH in March 2016. It remained silent until late Monday, when it fired off a test payment of 0.05 ETH, worth about $106, at 22:04 UTC.

Whale Alert flagged the transaction as a dormant pre-mine address holding 2,155 ETH that had become active again after 11.3 years.

The test payment went to a new address beginning with 0x1321beb8 and ending in 1A44. Within three minutes, the old wallet began receiving small amounts of ETH from two addresses crafted to resemble that recipient — one starting with 0x13211f, the other with 0x1321FB, both ending in 1A44. The turnaround — under three minutes between the first movement and the first dust — showed how quickly these campaigns respond once a dormant, high-value address surfaces in on-chain activity.

Both lookalikes were financed by accounts labeled “Fake_Phishing” on Etherscan, and the more active of the two sent 43 dust payments to the genesis wallet.

Owner sent the full 2,154.94 ETH 38 minutes later

At 22:20 UTC, the new wallet sent out 0.01 ETH, nearly all of which returned three minutes later. Then, 38 minutes after the initial test, at 22:42 UTC, the old wallet sent the full 2,154.94 ETH to the correct address, 0x1321beb8. The genesis wallet was left with about 0.0004 ETH, while the recipient held roughly 2,155 ETH.

The 0x1321FB lookalike sent again at 23:03 UTC, and a third lookalike ending in 1A44 dispatched zero-value transfers at 03:36 and 03:49 UTC on Tuesday. The dusting did not stop once the balance was gone, leaving forged entries planted in the wallet's history after the funds had moved on.

How address poisoning works

Address poisoning exploits the way wallets truncate long addresses. Instead of displaying all 42 characters, a wallet typically shows an abbreviated form such as 0x6D90…2E48. Attackers churn through millions of vanity addresses until one matches the first and last characters of a target's genuine contact. They then send dust or a zero-value transaction, which slots the fake address into the victim's recent history. If the user copies it for the next payment, the funds go to the attacker. The lookalikes here replicated every character a truncated display shows — 0x1321 at the front, 1A44 at the back — which is why verifying the full 42-character address, or copying from a saved contact rather than recent activity, is the check that defeats the match.

Ethereum transfers cannot be reversed. In December 2025, a trader lost around $50 million in USDT after a script poisoned the transaction history immediately after a $50 test transaction. In January 2026, a victim sent 4,556 ETH worth $12.25 million to an address controlled by an attacker, and another victim lost $600,000 in February.

According to Cryptopolitan, there are more than one million poisoning attempts on Ethereum each day. In January, Citi warned that spam was amplifying Ethereum's record transaction numbers, with most of the transfers worth less than $1.