A 2015 Ethereum genesis wallet moved 2,154.94 ETH, worth approximately $4.6 million, at 22:42 UTC on November 9 after remaining dormant for 11.3 years. Scammers sent dust transactions from three lookalike addresses within three minutes of the wallet's first outgoing test payment at 22:04 UTC, attempting an address poisoning attack. Address poisoning exploits truncated wallet displays by generating fake addresses matching the first and last characters of legitimate recipients, inserting them into transaction histories to trick users into copying malicious addresses. Ethereum faces over one million poisoning attempts daily, with recent cases including a $50 million USDT loss in December 2025 and a $12.25 million ETH loss in January 2026.
Genesis Wallet Transfers 2,154.94 ETH After 11.3 Years
On-chain records show the address received its first ether in Ethereum's genesis block in July 2015 and added another 755 ETH in March 2016. At 22:04 UTC on November 9 the wallet sent a test payment of 0.05 ETH, about $106 at the market rate, to a new recipient address starting 0x1321beb8 and ending 1A44. It was the wallet's first outbound transfer on record.
Within three minutes, two lookalike addresses began forwarding small amounts of ETH to the old wallet, one starting 0x13211f and the other 0x1321FB, both also ending in 1A44. Etherscan labels the accounts that funded both lookalikes "Fake_Phishing," and the busier one fired 43 separate dust payments at the genesis address.
At 22:20 UTC the new wallet sent out 0.01 Ethereum, nearly all of which returned three minutes later. At 22:42 UTC, 38 minutes after the first test, the old wallet transferred the full 2,154.94 ETH to the genuine recipient, according to the on-chain transaction record. The owner disregarded the lookalike entries throughout, leaving the genesis wallet with about 0.0004 ETH. Whale Alert flagged it as a pre-mine address active again after 11.3 years.
Scammers Deploy Address Poisoning Within Three Minutes
The pattern behind the dust is address poisoning, which turns the way wallets shorten long strings into an attack surface. Instead of displaying all 42 characters of a wallet address, most interfaces show a shortened form such as 0x6D90...2E48. Attackers churn through millions of generated addresses until one matches the first and last characters of a target's real contact, then send dust or a zero-value transaction that slots the fake entry into the victim's recent history.
After the poison lands, the fake address sits one copy command away from the user's clipboard, and zero-value transfers cost the attacker almost nothing. If the user copies that entry for the next payment, the money goes to the attacker, and Ethereum transfers cannot be reversed.
The three-minute reaction is the operative detail: the dusting keyed off the 0.05 ETH test payment, meaning poisoning operations watch the chain in real time. A third lookalike ending in 1A44 fired zero-value transfers at 03:36 and 03:49 UTC on Tuesday, against a wallet that now holds about 0.0004 ETH.
Ethereum Records Over 1 Million Daily Poisoning Attempts
Recent cases show the cost when the copy step fails. In December 2025, a trader lost about $50 million in USDT after a script poisoned the transaction history right after a $50 test payment. In January 2026, a victim sent 4,556 ETH, some $12.25 million, to an address controlled by an attacker, and another user lost $600,000 in February.
Monitoring puts poisoning attempts on Ethereum above one million per day. Citi warned in January that spam was inflating Ethereum's record transaction counts, with most of the additional transfers worth less than $1.
Storage choices do not settle the issue: the genesis stash sat untouched for over a decade, effectively a cold wallet holding, yet the risk surfaced only at the moment of transfer. A hardware wallet does not fix this class of risk, since a poisoned paste defeats offline key storage at the confirmation screen. The control that works is checking the full address.
FAQ
What happened to the Ethereum genesis wallet on November 9?
A 2015 Ethereum genesis wallet moved 2,154.94 ETH, worth approximately $4.6 million, at 22:42 UTC on November 9 after remaining dormant for 11.3 years. Scammers sent dust transactions from three lookalike addresses within three minutes of the wallet's first outgoing test payment at 22:04 UTC, attempting an address poisoning attack. The owner transferred the full balance to the correct recipient address despite the poisoning attempts.
How does address poisoning exploit Ethereum wallets?
Address poisoning exploits truncated wallet displays by generating fake addresses that match the first and last characters of legitimate recipients. Attackers send dust or zero-value transactions to insert these fake entries into a victim's transaction history. If the user copies the poisoned address for the next payment, the funds go to the attacker. Monitoring puts poisoning attempts on Ethereum above one million per day, with recent losses including $50 million in USDT in December 2025 and $12.25 million in ETH in January 2026.
