Just under 3 minutes after an Ethereum wallet from the network’s 2015 genesis block sent funds for the first time in 11 years, scammers started spraying dust at it.
The owner moved 2,154.94 ETH, worth some $4.6 million at the time, to the right place, disregarding the lookalike addresses.
Two lookalikes ending in 1A44 copied the new recipient
The address first obtained ether in Ethereum’s genesis block in July 2015, and another 755 ETH in March 2016. It didn’t send anything until late Monday, when it fired off a $106 test payment of 0.05 ETH at 22:04 UTC.
Whale Alert flagged the transaction as a dormant pre-mine address with 2,155 ETH that has been active again after 11.3 years.
The test moved to a new address starting 0x1321beb8 and ending 1A44. Within three minutes, the old wallet started to receive small amounts of ETH from two addresses contrived to look like that recipient.
First one starts at 0x13211f, the other at 0x1321FB. Both finish at 1A44.
Both lookalikes were financed by accounts labeled as “Fake_Phishing” by Etherscan. The busier lookalike sent 43 payments of dust to the genesis wallet.
Owner sent 2,154.94 ETH to the right address 38 minutes later
At 22:20 UTC the new wallet sent out 0.01 ETH and almost all of it returned three minutes later.
38 minutes after the first test, at 22:42 UTC, the old wallet sent the full 2,154.94 ETH to the correct address 0x1321beb8. The genesis wallet now has about 0.0004 ETH and the recipient has about 2,155 ETH.
The 0x1321FB lookalike sent again at 23:03 UTC and a third lookalike ending in 1A44 sent zero-value transfers at 03:36 and 03:49 UTC on Tuesday.
Address poisoning takes advantage of how wallets truncate long addresses. Instead of showing all 42 characters, a wallet displays something like 0x6D90…2E48.
Attackers churn through millions of vanity addresses until one matches the first and last characters of a target’s real contact.
They then send dust or a zero-value transaction which slots the fake address into the victim’s recent history. If the user copies it for the next payment, they send the money to the attacker.
Ethereum transfers cannot be reversed.
In December 2025, a trader lost around $50 million in USDT after a script poisoned the history right after a $50 test transaction.
In January 2026, a victim sent 4,556 ETH ($12.25 million) to an address controlled by an attacker. Another victim lost $600,000 in February.
According to Cryptopolitan, there are over a million poisoning attempts on Ethereum each day. In January, Citi warned that spam was amplifying Ethereum’s record transaction numbers, with most of the transfers worth less than $1.
If you're reading this, you’re already ahead. Stay there with our newsletter.