TLDR
- An Ethereum wallet dating to 2015 transferred approximately $4.6 million after more than a decade without outgoing transactions.
- The wallet attracted suspicious transfers within three minutes of sending a 0.05 ETH test payment.
- Two lookalike addresses attempted to imitate the legitimate recipient through address poisoning.
- One suspicious address reportedly sent 43 small transfers to the wallet.
- The wallet transferred 2,154.94 ETH to its original test recipient despite the attempted deception.
An Ethereum wallet dating to 2015 moved approximately $4.6 million despite an address-poisoning attempt on Monday. The attempted deception followed a small test payment, exposing a weakness in routine transfer checks.
CoinDesk identified the wallet as 0x7dDd…59Bc, first funded in Ethereum’s July 2015 genesis block. Another 755 ETH arrived in March 2016, before more than a decade without outgoing transfers.
At 22:04 UTC on November 9, the wallet sent 0.05 ETH to a new recipient. The destination began 0x1321beb8 and ended with 1A44, according to the transaction report.
Within three minutes, tiny transfers appeared from two addresses resembling that recipient. Both ended 1A44, but their opening characters differed from the destination. CoinDesk reported that Etherscan labeled their funding accounts “Fake_Phishing.” One lookalike reportedly sent 43 dust payments. These transfers placed misleading addresses in the wallet’s recent activity.
Test Payments Can Create Copy-Paste Risks
Address poisoning does not require attackers to breach a blockchain or steal private keys. Instead, it relies on someone copying a counterfeit address from transaction history. Wallet interfaces frequently abbreviate addresses, which can hide differences between genuine and forged destinations.
An October-reviewed investigation by blockchain analytics company Bitquery documented the broader threat. Researchers traced 1,635 victims and $76.1 million in measured losses over twelve months. Their dataset covered Ethereum mainnet through July 31, 2026, rather than all blockchains.
It also counted nearly 67 million poisoning attempts targeting approximately eight million wallets. Researchers characterized their measured loss total as a minimum, not a comprehensive estimate.
One December 2025 victim sent a $50 test payment before losing nearly $50 million in USDT. Bitquery found that a lookalike address entered the victim’s history after the test. The case shows why a successful test alone cannot authenticate a later copied address.
Larger Ethereum Transfer Avoids Poisoned Addresses
At 22:20 UTC, the new recipient forwarded 0.01 ETH, with most returning shortly afterward. At 22:42 UTC, the original wallet transferred 2,154.94 ETH. That followed the initial test by approximately 38 minutes.
The larger payment reached the original test recipient, not either reported lookalike address. This establishes that the visible attempt did not divert that transfer.
However, on-chain records cannot reveal how the sender selected or verified the destination. They also cannot establish the wallet owner’s identity or the reason for moving funds.
CoinCentral previously covered Citi’s warning that address-poisoning spam can distort Ethereum transaction activity. Bitquery recommends copying destinations from trusted sources rather than unverified transaction histories. Its findings also identify dust filtering as a potential safeguard for wallet providers.
