A Genesis-Era Wallet Awakens
TREE NEWS reports: An Ethereum address that received ETH in the network’s 2015 genesis block has moved funds for the first time in 11 years, successfully navigating a sophisticated address-poisoning attack. The wallet first sent a test transaction of 0.05 ETH (about $106) to a new address, then, 38 minutes later, transferred 2,154.94 ETH—worth roughly $4.6 million—to the intended recipient. Within three minutes of the test transaction, two addresses with highly similar first and last characters to the target address began sending tiny amounts of ETH to the old wallet, a classic address-poisoning tactic designed to trick users into copying the fraudulent address from their transaction history. The wallet owner did not fall for it, and the funds landed in the correct address.
Anatomy of an Address-Poisoning Attack
Address poisoning exploits the human tendency to verify only the beginning and end of a crypto address. Attackers generate vanity addresses that match those characters and send dust transactions to the victim’s wallet, hoping the victim will later copy the poisoned address from their history when making a transfer. The attack is low-cost and increasingly automated, and it has become a persistent threat for high-value wallets, especially those that have been inactive and may be managed with less frequent scrutiny.
Why This Case Matters
- Growing sophistication: The attackers reacted within minutes of the test transaction, indicating automated monitoring of large dormant wallets.
- Security hygiene: The use of a small test transfer before moving the full balance is a best practice that likely saved the funds.
- Dormant wallet risk: Long-inactive wallets are prime targets because owners may be less familiar with current attack vectors.
Industry Implications
The incident highlights the need for better wallet security tools, including address book whitelisting, transaction simulation, and hardware wallet confirmation screens that display the full address. It also underscores the value of education: even a simple test transaction can be the difference between losing millions and moving them safely. As more early-era wallets awaken—whether due to price movements, estate planning, or institutional custody changes—such attacks are likely to increase.
Looking Ahead
Wallet developers and security firms are racing to build defenses against address poisoning, including on-chain reputation systems and AI-powered transaction screening. For now, the lesson is clear: in crypto, vigilance at the moment of transfer remains the last line of defense. The $4.6 million transfer is a rare happy ending in a threat landscape that often ends in irreversible loss.
