A dormant wallet wakes up
A 2015 Ethereum genesis wallet sent funds for the first time in 11 years on Monday. The first move was small: a 0.05 ETH test payment at 22:04 UTC, worth about $106 at the time. Whale Alert flagged the address as a dormant pre-mine wallet with 2,155 ETH that had become active again after 11.3 years. The test went to a new address starting 0x1321beb8 and ending 1A44.
Lookalike addresses move in
Within three minutes, the old wallet began receiving tiny ETH payments from two addresses made to look like the recipient. One starts 0x13211f; the other starts 0x1321FB. Both end in 1A44. Etherscan labels the accounts that funded them as Fake_Phishing. The busier lookalike sent 43 dust payments to the genesis wallet.
This is address poisoning. Wallets shorten long addresses to something like 0x6D90…2E48. Attackers generate many vanity addresses until one matches the first and last characters of a real contact, then send dust or a zero-value transfer. The fake address lands in the victim’s recent history. If the user copies it later, the money goes to the attacker. Ethereum transfers cannot be reversed.
At 22:20 UTC, the new wallet sent out 0.01 ETH. Almost all of it came back three minutes later. Then, 38 minutes after the first test, at 22:42 UTC, the old wallet sent the full 2,154.94 ETH to the correct address. The genesis wallet now holds about 0.0004 ETH. The recipient has about 2,155 ETH.
Dust keeps coming
The 0x1321FB lookalike sent again at 23:03 UTC. A third lookalike ending in 1A44 sent zero-value transfers at 03:36 and 03:49 UTC on Tuesday. These transfers may not move value, but they can still put a bad address in front of someone at the wrong moment.
That risk is not theoretical. In December 2025, a trader lost around $50 million in USDT after a script poisoned the history right after a $50 test transaction. In January 2026, a victim sent 4,556 ETH, about $12.25 million, to an attacker-controlled address. Another victim lost $600,000 in February.
According to Cryptopolitan, there are more than a million poisoning attempts on Ethereum each day. In January, Citi warned that spam was amplifying Ethereum’s record transaction numbers, with most transfers worth less than $1. For large holders, the lesson is simple enough: check the full address, not just the first and last characters. I think the test payment here helped, but it also gave scammers a fresh target to copy.
