Genesis-Era Ethereum Wallet Moves $4.6M and Sidesteps Address-Poisoning Scam

An Ethereum wallet that has held coins since the chain's July 2015 genesis block moved roughly $4.6 million late Monday — and dodged a scam that was set up against it within three minutes.

The address, 0x7dDd57165c87A2707f025DCFC2508c09859Bc-class in age but precisely 0x7dDd57165c87A2707f025DCFC2508c09834759Bc, received its first ether in Ethereum's very first block in July 2015. It took in another 755 ETH in March 2016. Then it went silent. For over nine years, it never sent a single transaction.

That changed Monday at 22:04 UTC. The wallet sent a 0.05 ETH test payment, worth about $106, to a new address starting 0x1321beb8 and ending 1A44. Blockchain tracker Whale Alert flagged the move. For an owner about to shift a nine-figure-era fortune, a small test first is textbook practice.

It also rang a bell for the machines.

What happened in the next three minutes?

Within three minutes of the test payment, the old wallet started receiving a stream of tiny ether transfers. They came from two addresses built to look almost exactly like the one the owner had just paid — one starting 0x13211f, the other 0x1321FB, both ending in 1A44. Etherscan tags the funding accounts behind them as "Fake_Phishing." The busier of the two lookalikes sent 43 of these dust payments.

The trick is called address poisoning. Wallet apps typically show only the first and last few characters of an address. A scammer creates a lookalike and sprays dust into the target's transaction history. If the owner later copies the "recent recipient" from that history to send the real money, the funds go to the scammer instead.

The timing was not luck. On-chain data shows the lookalike addresses were funded within minutes of the test payment. Bots watch the chain around the clock for large, long-dormant wallets. A test transfer from one reads as a signal that a much bigger payment is coming — exactly the window these scammers hunt for.

How did the owner stay safe?

The owner didn't bite. They also took a second precaution along the way. At 22:20 UTC, the new wallet sent 0.01 ETH onward, and nearly all of it came back three minutes later — a round-trip check that the destination address was genuinely under the owner's control.

Then, at 22:42 UTC, 38 minutes after the first test, the old wallet sent 2,154.94 ETH — roughly $4.6 million at the time — to the correct 0x1321beb8 address. That address now holds about 2,155 ETH.

The playbook worked: test, verify, then move the balance. The scammers got nothing but gas fees for their trouble.

What does this change for wallet users?

Address poisoning has become a volume business on Ethereum. In January, Citi warned that poisoning spam was inflating the network's record transaction counts, with much of the new activity being transfers worth less than $1 — about the same amount these scammers sprayed at the 2015 wallet.

The practical lesson is narrow but real. Never copy a recipient address from a transaction history. Verify full addresses, character by character, against a known-good source. Treat any sudden burst of dust in a freshly active wallet as hostile, not noise.

As more 2015- and 2016-era wallets wake up and bots keep scanning for them, that discipline is likely to separate the owners who keep their stacks from the ones who don't.