Dormant for 11 Years, an Ethereum Address Awakens Only to Fall Victim to a Hacker's 'Poisoning Attack' 3 Minutes Later

November 10 - A wallet address starting with 0x7dD, traceable to Ethereum's genesis block in 2015, made its first outgoing transfer of 0.05 ETH, approximately $106, at 6:04 Beijing time on the 10th, to a test recipient address starting with 0x1321beb8 and ending with 1A44. The address received its first Ethereum in the genesis block in July 2015 and received an additional 755 ETH in March 2016, with no outgoing transfers until this transaction. On-chain monitoring account Whale Alert flagged this test transfer.

About 3 minutes after the test transfer was sent, the old wallet began receiving multiple micro ETH transfers from two addresses impersonating the target recipient address, one starting with 0x13211f and the other with 0x1321FB, both ending with 1A44. Etherscan shows that the accounts funding these two addresses are labeled "Fake_Phishing," with the more active one having sent 43 dust transfers. This tactic is known as address poisoning, where attackers write lookalike addresses into the target's transaction history to trick holders into copying the wrong address from recent records and transferring large funds.

At 6:20 Beijing time, the new address sent out 0.01 ETH, which was almost entirely returned about 3 minutes later. Then at 6:42, approximately 38 minutes after the first test transfer, the old wallet transferred 2,154.94 ETH, approximately $4.6 million, to the correct 0x1321beb8 address. The new address currently holds approximately 2,155 ETH.

Citi warned in January this year that address-poisoning spam transactions were driving up Ethereum network transaction counts, with a large number of transfers amounting to less than $1.