Scammers Hit Ethereum (ETH) Genesis Wallet With Dust From 3 Lookalike Addresses

Genesis Wallet Moves 2,154.94 ETH After 11.3 Years

Scammers dusted a dormant Ethereum (ETH) wallet from the network's 2015 genesis block within three minutes of its first outgoing payment in 11 years, and the owner still moved the full stash to the right place. On-chain records show the address received its first ether in Ethereum's genesis block in July 2015 and added another 755 ETH in March 2016, then stayed silent until late Monday. At 22:04 UTC on November 9 it sent a test payment of 0.05 ETH, about $106 at the market rate, to a new recipient address starting 0x1321beb8 and ending 1A44. It was the wallet's first outbound transfer on record, and the $106 size marked it as a check rather than a payment. Inside three minutes, two lookalike addresses began forwarding small amounts of ETH to the old wallet, one starting 0x13211f and the other 0x1321FB, both also ending in 1A44. The dormant crypto wallet had already drawn attention that evening: an on-chain alert from Whale Alert flagged it as a pre-mine address active again after 11.3 years, as posted late on November 9. Etherscan labels the accounts that funded both lookalikes “Fake_Phishing,” and the busier one fired 43 separate dust payments at the genesis address. At 22:20 UTC the new wallet sent out 0.01 Ethereum (ETH), nearly all of which returned three minutes later. Then, 38 minutes after the first test and at 22:42 UTC, the old wallet transferred the full 2,154.94 ETH, worth roughly $4.6 million at the Ethereum price at the time, to the genuine recipient, according to the on-chain transaction record. The owner disregarded the lookalike entries throughout, leaving the genesis wallet with about 0.0004 ETH and moving the full balance, close to 2,155 ETH, to the correct address. The 0x1321FB lookalike sent again at 23:03 UTC, keeping pressure on an address that had already emptied.

How Address Poisoning Exploits Truncated Addresses

The pattern behind the dust is address poisoning, which turns the way wallets shorten long strings into an attack surface. Instead of displaying all 42 characters of a wallet address, most interfaces show a shortened form such as 0x6D90...2E48, because the full string is unreadable at a glance. Attackers churn through millions of generated addresses until one matches the first and last characters of a target's real contact, then send dust or a zero-value transaction that slots the fake entry into the victim's recent history. After the poison lands, the fake address sits one copy command away from the user's clipboard, and zero-value transfers cost the attacker almost nothing, which is what makes the technique scalable. If the user copies that entry for the next payment, the money goes to the attacker, and Ethereum (ETH) transfers cannot be reversed. Recent cases show the cost when the copy step fails. In December 2025, a trader lost about $50 million in USDT after a script poisoned the transaction history right after a $50 test payment. In January 2026, a victim sent 4,556 ETH, some $12.25 million, to an address controlled by an attacker, and another user lost $600,000 in February. The volume is large enough to distort network statistics: monitoring puts poisoning attempts on Ethereum above one million per day. Citi warned in January that spam was inflating Ethereum's record transaction counts, with most of the additional transfers worth less than $1. Storage choices do not settle the issue either: the genesis stash sat untouched for over a decade, effectively a cold wallet holding, yet the risk surfaced only at the moment of transfer, when the payable address has to be confirmed character for character. COINOTAG's walkthrough on how to use Ethereum covers checking a transaction's recipient before it is signed.

The three-minute reaction is the operative detail: the dusting keyed off the 0.05 ETH test payment, the step large holders run to confirm a recipient, meaning poisoning operations watch the chain in real time. This owner cleared the check, but the on-chain record leaves the seam open. A third lookalike ending in 1A44 fired zero-value transfers at 03:36 and 03:49 UTC on Tuesday, against a wallet that now holds about 0.0004 ETH. A hardware wallet does not fix this class of risk, since a poisoned paste defeats offline key storage at the confirmation screen; the control that works is checking the full address. The episode also lands weeks after SlowMist's warning to Ethereum (ETH) users of a Swarm supply chain attack spread through GitHub.