11-Year-Old’s Ethereum Wallet Moves $4.6M, Foils Scam in Minutes

An 11-year-old Ethereum wallet moved $4.6 million and dodged a scam set up in minutes

A long-dormant Ethereum wallet dating back to the network’s 2015 launch moved roughly 2,154.94 ETH (about $4.6 million) on July 21—then avoided a common scam that appeared almost immediately after the wallet became active on-chain.

The address, described as a pre-mine wallet, had been inactive for about 11 years before sending an initial “test” payment. Large movements from old wallets are routinely tracked by automated systems, and even a small transfer can act as a signal that a much larger transaction may follow.

On-chain data shows that within minutes of the test payment, the wallet began receiving a stream of tiny ether transfers from two addresses engineered to look nearly identical to the recipient address the owner had just used.

The lookalike sender addresses shared the same opening characters—one beginning 0x13211f and the other 0x1321FB—and both ended in 1A44. Etherscan labels indicate both were funded by accounts tagged “Fake_Phishing”, and the more active of the two addresses sent 43 dust transfers.

This tactic is known as address poisoning. The goal is to place familiar-looking addresses into a victim’s transaction history so that when the victim later copies a past counterparty address—or selects a recent one—they may mistakenly send funds to the attacker’s lookalike address.

In this case, the owner took steps that prevented a mis-send. At 22:20 UTC, a newly used wallet sent 0.01 ETH onward, and nearly all of it returned about three minutes later, indicating a precautionary check before moving a larger amount.

Then at 22:42 UTC, about 38 minutes after the first test, the original 2015-era wallet transferred 2,154.94 ETH to the intended address beginning 0x1321beb8. That receiving address now holds about 2,155 ETH.

The incident underscores how quickly scammers react to activity from high-value wallets, particularly those that have been dormant for years. Bots monitoring the Ethereum network can detect a reactivated wallet in near real time and deploy poisoning transactions within minutes.

Address poisoning has also become a measurable source of network activity. In January, Citi warned that poisoning spam was contributing to record transaction counts on Ethereum, with much of the activity consisting of transfers worth less than $1—similar in size to the dust amounts sent to this 2015 wallet.

• What happened: A pre-mine Ethereum wallet moved about $4.6 million after 11 years of inactivity.
• What scammers did: Lookalike addresses quickly sent dust transfers designed to appear in the wallet’s history.
• Why it matters: The episode illustrates how automated poisoning campaigns target large wallets as soon as they show signs of life, and how small “test” transactions can trigger that attention.