An Ethereum wallet that had been inactive for more than 11 years has transferred approximately $4.6 million worth of ETH while successfully avoiding an attempted cryptocurrency scam, according to blockchain monitoring reports.
The wallet, identified by an address beginning with 0x7dDd, received its first Ether during Ethereum’s genesis block in July 2015. It later received another 755 ETH in March 2016 and had no recorded outgoing transfers until November 9, 2026.
Test Transaction Triggers Scam Attempt
The wallet’s first outgoing transaction occurred at approximately 22:04 UTC on November 9, when it sent 0.05 ETH, worth around $106, to a new receiving address. Blockchain tracking service Whale Alert flagged the movement, noting that a dormant pre-mine address containing 2,155 ETH had been activated after 11.3 years.
Within about three minutes, the original wallet began receiving numerous tiny ETH transfers from two suspicious addresses designed to resemble the legitimate recipient. Both fraudulent addresses copied portions of the destination address, including its final characters. One of the suspicious addresses reportedly initiated 43 small transfers, and blockchain explorer Etherscan identified the accounts funding the lookalike addresses as associated with phishing activity.
The attackers were attempting address poisoning, a technique that inserts misleading addresses into a wallet’s transaction history. Because many wallets display only the beginning and ending characters of an address, users can mistakenly select a fraudulent recipient when copying information from previous transactions.
Main Transfer Reaches Intended Destination
The attempted attack appears to have failed. At approximately 22:42 UTC, about 38 minutes after the initial test, the original wallet transferred 2,154.94 ETH, worth approximately $4.6 million, to the intended destination. The funds were not redirected to the suspicious addresses.
After the initial 0.05 ETH transaction, the receiving wallet sent a smaller 0.01 ETH transfer, with nearly all of the funds subsequently returned. The main transaction followed shortly afterward.
The incident illustrates how quickly automated scammers can respond to activity involving valuable cryptocurrency wallets. Unlike traditional phishing attempts that often rely on emails or malicious websites, address poisoning exploits the transparency of public blockchains. Attackers can monitor transactions, identify potential targets, and generate visually similar addresses before a user completes a larger transfer.
It also shows why test transactions alone cannot guarantee security. A small successful payment confirms that a particular address can receive funds, but users must still verify that the destination address has not changed before making another transfer.
The wallet’s owner and the reasons for moving the funds after more than a decade remain unknown. There is also no confirmed evidence that the transaction represents an immediate cryptocurrency sale.
