Dormant Ethereum Wallet Moves $4.6 Million. Scammers Set a Trap in Three Minutes

One of the Ethereum wallets that has existed since the network's launch in 2015 sent funds for the first time in over a decade, and shortly after became the target of an automated attack. However, the owner did not fall for the fabricated addresses and ultimately transferred 2,154.94 ETH, worth approximately $4.6 million, to the correct account.

The address received its first ETH in the Ethereum genesis block, mined in July 2015. In March 2016, an additional 755 ETH was added to the wallet. For the following years, no outgoing transfers were recorded from it.

The situation changed on Monday, November 9. At 10:04 PM local time in Poland, the owner sent 0.05 ETH, about $106, to a new address starting with 0x1321beb8 and ending with 1A44. This small test transaction was recorded by Whale Alert.

Just three minutes later, the old wallet began receiving a series of small ETH transfers. These came from two addresses that were strikingly similar to the one to which the test amount was previously sent. One started with 0x13211f, and the other with 0x1321FB. Both ended with the same string of characters: 1A44.

According to data available on the Etherscan explorer, both suspicious addresses were funded by accounts labeled as "Fake_Phishing." One of them sent as many as 43 small transfers. Their aim was to insert fake addresses into the victim's transaction history. source: Etherscan

[CLICK TO ENLARGE]

Wallet User Trap

This is an example of an attack known as address poisoning. Scammers generate wallets that resemble those previously used by the victim and then send small amounts of cryptocurrency to their address. As a result, fake accounts appear in the transaction history and can be confused with legitimate recipients.

The mechanism exploits the way many wallet applications present addresses. Instead of displaying the full string of characters, interfaces often show only the beginning and end. As a result, two different addresses can look almost identical.

Criminals hope that the user will copy the recipient directly from the transaction history during the next transaction without carefully checking the entire address. In the case of large transfers, such a mistake can mean irreversible loss of funds.

In this case, the scammers reacted exceptionally quickly. Automated bots can monitor the blockchain for large, long-inactive wallets. The first outgoing transfer can signal to them that the owner is preparing to move a larger amount of cryptocurrency. A small test payment then creates an opportunity to substitute a fake address.

We have already reported on similar threats on BitHub.pl. In this article, we described the case of an investor who lost nearly 400,000 PLN due to transaction history poisoning.

Owner Sent $4.6 Million to the Correct Address

This time, the attempted scam ended in failure. The wallet owner took an additional precaution. At 10:20 PM UTC, the new recipient address sent back 0.01 ETH, almost all of which returned three minutes later. This move could have been to check whether control over the target wallet was functioning correctly.

At 10:42 PM UTC, 38 minutes after the first test transaction, 2,154.94 ETH worth approximately $4.6 million was sent from the long-standing wallet. The funds went to the correct address starting with 0x1321beb8. According to Etherscan data regarding the recipient's wallet, about 2,155 ETH has been accumulated there.

This case shows how quickly automated scams can react to user activity on the blockchain. The problem has a much broader scale than a single theft attempt. In January 2026, analysts from Citi Bank warned that mass sending of small transfers by scammers could artificially inflate Ethereum's activity statistics. A large portion of additional transactions had values below $1.

Meanwhile, an analysis by Bitquery regarding address poisoning on Ethereum revealed that over a 12-month period up to July 31, 2026, scammers caused losses amounting to at least $76.1 million. Affected were 1,635 users, and the campaigns involved nearly 8 million wallets.

The most important rule remains unchanged: before sending cryptocurrencies, always check the entire recipient address, not just the beginning and end. For large amounts, it is also advisable to make a small test transfer and confirm the recipient's details through an independent channel.

Read also:
Coinbase Granted Full Trust Bank License. OCC Decision Took Effect
Glamsterdam Could Threaten Thousands of Ethereum Smart Contracts. Developers Propose Two Solutions

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.