Key Highlights
- An Ethereum whale avoided an address poisoning scam, successfully moving 2,154.94 ETH (roughly $4.6 million) to a secure wallet.
- Automated bots targeted the long-dormant 2015 wallet within minutes of an initial test transaction using lookalike addresses.
- Wall Street giant Citi previously warned that low-value address poisoning attacks are inflating Ethereum’s transaction volume metrics.
Dormant Ethereum Wallet Evades Address Poisoning Attack
A long-dormant Ethereum investor from 2015 successfully transferred 2,154.94 ETH—valued at approximately $4.6 million—narrowly avoiding a sophisticated address poisoning attack. The attack was triggered shortly after the wallet owner executed an initial test transaction to prepare for the massive capital migration. Automated scam networks continually monitor the blockchain for activity from vintage accounts, leveraging early test transfers as signals that a substantial transaction is imminent.
The mechanics of the exploit rely heavily on deceptive transaction history manipulation. If the owner then copies the “recent recipient” from that history to send the real money, the funds go to the scammer. It works best on someone who has just sent a test payment and is about to send everything else, which is exactly where this owner was. According to on-chain data, lookalike addresses generated by bad actors were funded within minutes of the owner’s initial test transaction, aiming to trick the sender into copying an identical-looking fraudulent address from their transaction log.
Careful Precautions Prevent Millions in Losses
Despite the scammers’ rapid efforts, the wallet owner did not fall for the deception and enacted further security measures before executing the full transfer. At 22:20 UTC, the newly targeted destination wallet sent 0.01 ETH onward, and nearly all of the test amount returned just three minutes later, confirming active control and accuracy across the intended addresses.
Following this secondary verification step, the historical wallet officially transferred the full balance at 22:42 UTC—38 minutes after the original test took place. The 2,154.94 ETH was safely delivered to the verified destination address starting with 0x1321beb8, bringing that recipient wallet’s total balance to approximately 2,155 ETH and leaving the attack completely unsuccessful.
Why This Matters
Address poisoning has rapidly scaled into a widespread, volume-driven issue on the Ethereum network. Attackers deploy automated scripts to blanket the network with micro-transactions, hoping high-value users prioritize convenience by copying transfer destinations directly from their recent transaction histories rather than verifying character strings.
The scale of this issue extends into broader blockchain analytics. In January, Citi warned that poisoning spam was inflating the network’s record transaction counts with much of the new activity being transfers worth less than $1 — about the same amount these scammers sprayed at the 2015 wallet. This incident underscores the necessity of strict, step-by-step transaction validation for cryptocurrency holders, especially when reviving long-dormant funds amidst aggressive on-chain bot surveillance.
Frequently Asked Questions
What is Ethereum address poisoning?
Address poisoning is a deceptive tactic where scammers send negligible amounts of cryptocurrency (often under $1) from a lookalike address—sharing the same initial and final characters as the victim’s intended destination—directly to the victim’s wallet. The objective is to populate the victim’s recent transaction feed so that they inadvertently copy the scammer’s address for their next major transfer.
How did the wallet owner avoid losing the 2,154.94 ETH?
The wallet owner avoided the trap by remaining vigilant after the first test transfer. Rather than copying a recipient address from the recent transaction log, the owner executed an additional 0.01 ETH round-trip verification transfer between wallets before sending the full $4.6 million sum to the legitimate 0x1321beb8 address.
Why are dormant cryptocurrency wallets specifically targeted?
Automated blockchain bots monitor the network 24/7 for activity in high-balance, long-dormant wallets. Because movement after years of inactivity often starts with a small test transaction followed quickly by a full balance transfer, scammers immediately deploy lookalike addresses to exploit that short operational window.
