Image Credit: Shutterstock
- A genesis-era Ethereum wallet faced a lookalike scam during its first outgoing transfer.
- The failed attack targeted the wallet just 72 seconds after its test payment.
- About 2,155 ETH successfully reached the intended recipient despite the decoy transactions.
An Ethereum wallet funded when the network launched in 2015 faced a lookalike-address scam just 72 seconds after making its first outgoing transfer.
Luckily, the attempt failed to divert the main payment. About 2,155 ETH, worth roughly $4.6 million, reached the same address as the wallet’s initial 0.05 ETH test.
Lookalike Payments Arrive 72 Seconds After the Test
The sender, 0x7dDd57165c87A2707f025DCFC2508c09834759Bc, received ETH in Ethereum’s genesis block, the chain’s first block, in July 2015. Another 755 ETH arrived on March 29, 2016.
It made no outgoing transactions until 22:04:11 UTC on Monday, Nov. 9. That first payment sent 0.05 ETH, worth about $106, to an address beginning 0x1321beb8 and ending 1A44. Blockchain tracker Whale Alert flagged the wallet’s activation immediately.
The first decoy appeared just over a minute later. At 22:05:23 UTC, an address beginning 0x13211f and ending 1A44 sent 0.0000001 ETH back to the original wallet. It made 43 tiny payments over roughly 37 minutes, each worth less than one cent.
A second lookalike, beginning 0x1321FB and also ending 1A44, sent a tiny payment at 22:08 UTC. Both mimicked the test recipient’s visible address characters. Etherscan tags the accounts that funded them as ‘Fake_Phishing’.
However, the large transfer at 22:42 UTC went to the original recipient. The transaction carried 2,154.9495 ETH, approximately 38 minutes after the test payment.
A Test Payment Does Not Secure the Next Transfer
Address poisoning is becoming an increasing problem and usually targets the way people reuse addresses. An attacker sends a negligible amount from a lookalike account, hoping the recipient later copies that account from transaction history instead of using the verified destination.
Wallets often shorten addresses on screen, showing the beginning and end while hiding the middle. In this instance, the matching characters could make the decoys look familiar at a glance.
Receiving those payments does not give an attacker control of the wallet. The trap depends on the owner approving a later transfer to the wrong address.
A successful test therefore confirms only where that test went. The destination still needs checking when the larger payment is prepared, particularly if the address is copied again.
Wallet provider MetaMask gives a direct warning:
“Avoid copying addresses from your transaction history.”
For repeat payments, it recommends saving verified addresses in contacts. Before signing, users should compare the complete destination, including its middle characters, rather than relying on a familiar-looking start and finish.
