Old Ethereum Wallet Escapes Address Poisoning Scam
The owner first made a test payment and then avoided a fast address poisoning attack using lookalike addresses. The incident highlights the persistent phishing risk around old Ethereum wallets.
Key Takeaways
- An old Ethereum wallet from 2015 sent money for the first time on Monday and avoided an address poisoning scam.
- The owner first made a test payment of 0.05 ETH and then sent 2,154.94 ETH, about $4.6 million, to the correct address.
- Within three minutes of the test, lookalike addresses appeared in the transaction history, a known trick where only the first and last characters seem to match.
An old Ethereum wallet that dates back to the network’s launch in 2015 made its first outgoing transfer on Monday and escaped an address poisoning scam that was set up within minutes. The owner ultimately sent 2,154.94 ETH, worth about $4.6 million (€4.1 million), to the correct address.
First Test Payment
The wallet, 0x7dDd57165c87A2707f025DCFC2508c09834759Bc, received its first ether in Ethereum’s genesis block in July 2015 and got another 755 ETH in March 2016. Until Monday, the address had never sent anything. At 22:04 UTC, the owner first made a test payment of 0.05 ETH, worth about $106 (€95), to a new address that started with 0x1321beb8 and ended with 1A44.
That small test immediately stood out. Blockchain tracker Whale Alert reported the move, after which the old wallet address received a series of small ether transactions within three minutes. According to the data, they came from two lookalike addresses that looked almost identical to the address the owner had just sent to.
How Address Poisoning Works
The trick is called address poisoning. Wallets often show only the first and last characters of an address, which means a fake address in a transaction history can look like the real one. If a user later copies a recent address from that history, the money can end up going to the scammer.
In this case, the lookalike addresses were funded within minutes of the test payment. Etherscan shows that both addresses were funded by accounts carrying the Fake_Phishing label, and the busiest address sent 43 such small payments. The owner did not fall for it and later also sent 0.01 ETH back and forth as an extra check before the full amount was sent.
Why This Matters
Address poisoning has become a recurring security problem on Ethereum. In January, Citi already warned that this kind of spam is driving up the number of transactions on the network, with many payments below $1 (€0.89). Security researchers also see bots constantly tracking large, long-dormant wallets and quickly creating lookalike addresses as soon as one of those wallets moves. That makes the risk especially high for users who work with copied addresses and only check the first and last characters.