Ethereum genesis wallet moves $4.6 million after evading address-poisoning scam

Traders Union
All News
Crypto
Ethereum genesis wallet $4.6M move

Highlights

An Ethereum genesis wallet transferred 2,154.94 ETH (about $4.6 million) for the first time since 2016 after successful test payments on June 10.
Within minutes of the test payment, automated actors attempted address poisoning by sending over 43 dust transactions from spoofed addresses ending in '1A44.'
Citi warned in January that address poisoning scams are inflating Ethereum transaction counts, with spam transfers often under $1 matching this incident's activity.

Transfer sequence and scam attempt

As first reported by CoinDesk, the wallet received its first ether in Ethereum's genesis block in July 2015 and later took in another 755 ETH in March 2016 before remaining inactive for years. It sends out funds for the first time on Monday, making a 0.05 ETH test payment worth about $106 at 22:04 UTC to a new address beginning 0x1321beb8 and ending 1A44, a move flagged by blockchain tracker Whale Alert.

Within three minutes, the old wallet starts receiving tiny ether transfers from two addresses crafted to closely resemble the destination of the test payment. Both lookalike addresses share the same ending, 1A44, and Etherscan data shows they are funded by accounts tagged as "_Fake_Phishing_," with the more active address sending 43 dust payments.

The tactic is known as address poisoning, in which scammers send small amounts of cryptocurrency from similar-looking addresses so they appear in a target's transaction history. Because many wallet apps display only the first and last characters of an address, users who copy a recent recipient instead of verifying the full destination can end up sending funds to the wrong account.

The wallet owner does not fall for the attempt. At 22:20 UTC, the new wallet sends 0.01 ETH onward, and nearly all of it returns three minutes later, suggesting an additional verification step before the main transfer.

Broader risks for Ethereum users

At 22:42 UTC, 38 minutes after the initial test transfer, the old wallet sends 2,154.94 ETH, roughly $4.6 million, to the intended 0x1321beb8 address. The receiving wallet now holds about 2,155 ETH.

The episode shows how quickly automated actors react when dormant, high-balance wallets stir on-chain. Data indicates the spoofed addresses are funded within minutes of the test payment, consistent with bots tracking the blockchain around the clock for signals that a larger transfer may follow.

Address poisoning has become a scale business on Ethereum. In January, Citi warns that poisoning spam is inflating the network's record transaction counts, with much of the added activity made up of transfers worth less than $1, broadly in line with the dust amounts sent to this wallet.

Earlier, we reported that Visa agreed to a $2.4 billion acquisition of anti-fraud firm BioCatch as cybersecurity dealmaking stayed active.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.